Command line sets a custom .NET AppDomainManager assembly

Siemphony@siemphonymediumT1574.014unverified

AppDomainManager injection redirects a .NET host to load an attacker assembly through one of two mechanisms: the APPDOMAIN_MANAGER_ASM and APPDOMAIN_MANAGER_TYPE environment variables, or the appDomainManagerAssembly and appDomainManagerType attributes in a .config file — both named directly in Microsoft's own AppDomainManager documentation and the public AppDomainManagerInject tooling this technique's citations point to. This rule matches only the narrow case where one of those four literal marker strings is visible on the command line of the process being launched — a `cmd /c set APPDOMAIN_MANAGER_ASM=... && app.exe` chain, a PowerShell `$env:` assignment on the same line, or an inline reference to the config attribute name. It cannot see AN1433's other two legs: an env var set by a separate parent process (invisible to the child's own CommandLine), or a .config file edited out-of-band and read silently at next launch with nothing to show on the command line at all — both would need the file_event and image_load correlation AN1433 also asks for, which is a cross-event join lib/sigma has no construct for. The brief maps Security 4688 onto Sigma's process_creation category, which is Sysmon-shaped, and this rule is written in that vocabulary (Image, CommandLine); on a 4688 feed the same values are NewProcessName and CommandLine, so that feed needs a field mapping before this rule matches at all, and 4688 itself only exists once Audit Process Creation is enabled, with CommandLine requiring the separate "Include command line in process creation events" policy — neither is on in a default install or in the MS/CIS baselines, and zero rows here would read as quiet when it actually means blind. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0517, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (ProcessCommandLine contains "APPDOMAIN_MANAGER_ASM" or ProcessCommandLine contains "APPDOMAIN_MANAGER_TYPE" or ProcessCommandLine contains "appDomainManagerAssembly" or ProcessCommandLine contains "appDomainManagerType")

Splunk · SPL

Run this as a search.

index=* (CommandLine="*APPDOMAIN_MANAGER_ASM*" OR CommandLine="*APPDOMAIN_MANAGER_TYPE*" OR CommandLine="*appDomainManagerAssembly*" OR CommandLine="*appDomainManagerType*")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.command_line) LIKE "*appdomain_manager_asm*" OR TO_LOWER(process.command_line) LIKE "*appdomain_manager_type*" OR TO_LOWER(process.command_line) LIKE "*appdomainmanagerassembly*" OR TO_LOWER(process.command_line) LIKE "*appdomainmanagertype*")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(APPDOMAIN_MANAGER_ASM|APPDOMAIN_MANAGER_TYPE|appDomainManagerAssembly|appDomainManagerType)</field>    <description>Command line sets a custom .NET AppDomainManager assembly</description>    <mitre>      <id>T1574.014</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: registry_persistence
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: bd764e62-9849-4b19-bc10-9b7843202629

ATT&CKT1574.014

T1574.014AppDomainManager

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonregistry persistence

registry persistenceAI draft — unreviewed

01 · What this rule detects

AppDomainManager injection redirects a .NET host to load an attacker-controlled assembly through one of two mechanisms: the APPDOMAIN_MANAGER_ASM/APPDOMAIN_MANAGER_TYPE environment variables, or the appDomainManagerAssembly/appDomainManagerType attributes in a .config file — both named directly in Microsoft's own AppDomainManager documentation and the public tooling this technique's citations point to. This rule matches the narrow case where one of those four literal strings is visible on the launching process's own command line.

02 · Telemetry you need

Sysmon EventID 1 (process_creation, product windows), field CommandLine. The brief maps this onto Security 4688, which is Sysmon-shaped in the brief's vocabulary; on an actual 4688 feed the equivalent fields are NewProcessName/CommandLine, so that feed needs a field mapping before this rule matches anything. 4688 itself requires Audit Process Creation to be enabled, and its CommandLine field needs the separate "Include command line in process creation events" policy — neither is on by default or in the MS/CIS baselines, so zero rows can mean the audit policy is off rather than that nothing happened.

03 · How the logic works

There is a single selection block: CommandLine|contains against four literals — APPDOMAIN_MANAGER_ASM, APPDOMAIN_MANAGER_TYPE, appDomainManagerAssembly, appDomainManagerType — with condition: selection requiring just one. In practice only the first two carry real coverage. An adversarial review of this rule found that the two config-attribute names are structurally dead weight for a CommandLine selector: the .config mechanism plants those strings inside a <ProcessName>.exe.config file's <runtime> element, which is file content, not command-line text — that string only ever appears on a command line in the rare case someone types the attribute name into an argument, such as a config file path. The rule's own description partially concedes this, noting a .config file "edited out-of-band" leaves "nothing to show on the command line," while still listing "an inline reference to the config attribute name" as one of the three patterns caught — an overstatement of how often that leg actually fires. Two AN1433 legs are not attempted at all: an env var set by a separate parent process (invisible to the child's own CommandLine), and the out-of-band .config edit — both need a file_event-to-process_creation join lib/sigma has no construct for.

04 · Common false positives

Internal .NET applications that legitimately ship a custom AppDomainManager for licensing, instrumentation or telemetry, and set APPDOMAIN_MANAGER_ASM or appDomainManagerAssembly on their own launch line or embedded config, will match. So will QA and CI test harnesses or .NET training material exercising AppDomainManager extensibility as part of a build, regression suite or walkthrough — the same variable and attribute names appear in legitimate exercises of the feature MITRE is describing abuse of.

05 · Detection maturity

tier_1: This rule has never fired against a real log line and sits at the lowest DeBMM tier — an authored scaffold, not a validated detection. It needs the audit policy confirmed as enabled, the config-attribute legs re-evaluated for real contribution, and a test run against genuine CommandLine data before it earns any higher maturity standing.

Tuning & false positivesexperimental · 2 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Treat the two config-attribute literals (appDomainManagerAssembly, appDomainManagerType) as low-confidence padding rather than real coverage — consider dropping them from the selection, or splitting them into a separately-labelled secondary selector so a hit on those two carries visibly less weight than a hit on the two environment-variable literals, which are the leg doing the actual work. If your environment has known internal tools that legitimately set these variables, allowlist their signed publisher or install path rather than the bare string match.

Declared by the author

Internal .NET applications that legitimately ship a custom AppDomainManager assembly for licensing, instrumentation or telemetry and set APPDOMAIN_MANAGER_ASM or appDomainManagerAssembly on their own launch command line or embedded .config.
QA or CI test harnesses and .NET training material that exercise AppDomainManager extensibility as part of an automated build, regression suite or walkthrough, invoking the same environment variable or config attribute names on the command line.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1574.014, evaluated against their process_creation events.

Share this rule

/u/siemphony/bd764e62-9849-4b19-bc10-9b7843202629

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Command line sets a custom .NET AppDomainManager assembly

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it