dotnet-counters.exe is a .NET diagnostic tool used to collect runtime performance counters from applications. Attackers can abuse diagnostic utilities to run trusted Microsoft code and potentially blend activity with legitimate troubleshooting. Defenders should monitor for invocation against unexpected processes, unusual parameters, and use on systems where .NET diagnostics are not expected.
What dotnet-counters.exe Is Used For
dotnet-counters.exe is a .NET diagnostics utility that reads runtime counters from running applications. In normal use, it helps engineers understand performance, but because it is a trusted Microsoft binary it can also be repurposed as a low-friction execution and observation tool.
For defenders, the key point is that a legitimate diagnostic program can look operationally normal even when it appears in an environment or process tree where .NET troubleshooting should not be happening. That makes the surrounding context, not just the binary name, important for interpretation.
Why It Matters in Windows Abuse Scenarios
Windows LOLBins are attractive because they are already present, signed, and often permitted by default policy. A tool like dotnet-counters.exe can help an attacker blend into administrative activity, particularly where command lines are noisy, diagnostics are expected, or monitoring focuses only on obviously malicious executables.
This pattern sits in the broader class of trusted binary abuse, where the danger is less about the tool itself and more about the cover it provides. Detection should therefore look for who launched it, what it was pointed at, and whether the target process and host are consistent with legitimate troubleshooting.
How to Recognise Suspicious Use
Suspicious use often shows up as unexpected parent processes, invocation on servers or endpoints that rarely need .NET diagnostics, and command lines that do not match standard support workflows. Repeated execution across multiple hosts, especially outside maintenance windows, is another warning sign.
Because this utility is designed to observe runtime behaviour, unusual parameters or targeting of unfamiliar processes can indicate misuse rather than troubleshooting. Correlating process creation, command line logging, and host role is usually more useful than relying on the executable name alone.
Defensive Controls and Investigation Priorities
Application control and command-line visibility are the most practical defenses for this class of abuse. Living off the Land Guide is a useful reference for understanding how trusted binaries are abused and how to harden against them with allowlisting and monitoring.
When dotnet-counters.exe appears unexpectedly, investigators should verify whether the host should have .NET diagnostics tooling at all, then review the process tree, command-line arguments, and any concurrent administrative activity. If the tool was used during a compromise, treat it as part of the attacker’s tradecraft and look for adjacent LOLBin activity rather than isolating the event.
Risk and Threat Considerations
Abuse of trusted diagnostics creates an evasion advantage because defenders may mistake attacker activity for legitimate support work. The risk increases when the tool is allowed broadly, when process telemetry is incomplete, or when response teams do not distinguish expected maintenance use from opportunistic abuse.
Failure mechanism: An adversary launches a signed Microsoft diagnostic utility to reduce suspicion, gather runtime visibility, and operate within normal-looking Windows administration patterns.
Impact: This can delay detection, obscure malicious process relationships, and make it easier to sustain access while blending into routine operational noise.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1218 — Signed Binary Proxy Execution | dotnet-counters.exe is a signed Microsoft utility that can be abused to blend malicious activity into trusted execution. |
| Recommendation — Map suspicious dotnet-counters.exe activity to T1218 and hunt for trusted-binary abuse patterns in process telemetry. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Suspicious use is best detected through process creation and command-line logging. |
| CIS-2 — Inventory and Control of Software Assets | Unexpected use is easier to spot when diagnostic tools are inventoried and governed by asset policy. | |
| Recommendation — Enable and review detailed process and command-line logging to surface unexpected dotnet-counters.exe execution. Maintain an approved software inventory so unneeded diagnostic utilities are easier to detect and restrict. | ||
| NIST SP 800-53 Rev 5 | AU-12 — Audit Record Generation | This term depends on generating forensic records for process launches and arguments. |
| SI-4 — System Monitoring | Monitoring for unexpected diagnostic-tool use is a direct detection requirement for this LOLBin abuse pattern. | |
| Recommendation — Generate audit records for process creation and command lines to support investigations involving dotnet-counters.exe. Monitor for unusual diagnostic-tool execution on hosts where .NET troubleshooting is not expected. | ||
Practitioner Guidance
What to watch for: Treat dotnet-counters.exe as a context-sensitive signal, not a verdict. It is most meaningful when combined with host role, process lineage, command-line detail, and whether the execution aligns with an approved support or observability workflow.
Practitioner takeaway: The strongest detections for LOLBin abuse usually come from understanding expected administration patterns first, then flagging departures from them.