Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1574.012sub-technique of T1574 Hijack Execution Flow

COR_PROFILER

Windowsnothing on this site yetT1574.012 on attack.mitre.org

Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of programs that load the.NET CLR. The COR_PROFILER is a.NET Framework feature which allows developers to specify an unmanaged (or external of.NET) profiling DLL to be loaded into each.NET process that loads the Common Language Runtime (CLR). These profilers are designed to monitor, troubleshoot, and debug managed code executed by the.NET CLR.

MITRE ATT&CK 19.2, retrieved 2026-09-12

If this is happening now

1

Checklists and playbooks to open while the alert is still live.

how MITRE says to see it

Detection Strategy for Hijack Execution Flow using the Windows COR_PROFILER.

  • Modification of COR_PROFILER-related environment variables or Registry keys (COR_ENABLE_PROFILING, COR_PROFILER, COR_PROFILER_PATH), combined with anomalous.NET process creation or unmanaged DLL loads.

what reduces it

  • M1038 Execution Prevention. Identify and block potentially malicious unmanaged COR_PROFILER profiling DLLs by using application control solutions like AppLocker that are capable of auditing and/or blocking unapproved DLLs.
  • M1018 User Account Management. Limit the privileges of user accounts so that only authorized administrators can edit system environment variables.
  • M1024 Restrict Registry Permissions. Ensure proper permissions are set for Registry hives to prevent users from modifying keys associated with COR_PROFILER.

the rest of T1574

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.