persistence-info.github.io

View on GitHub

.NET Startup Hooks

Location:

DOTNET_STARTUP_HOOKS environment variable

Classification:

Criteria Value
Permissions Admin
Security context User; System1
Persistence type Other
Code type DLL2
Launch type Automatic3; User initiated4
Impact Non-destructive
OS Version All OS versions
Dependencies OS only
Toolset Scriptable

Description:

You can set the DOTNET_STARTUP_HOOKS=path/to/assembly.dll environment variable and then run a .NET app and the runtime will load your assembly.dll before Main and call StartupHook.Initialize() in it.

References:

https://github.com/dotnet/runtime/blob/main/docs/design/features/host-startup-hook.md

Credits:

@KirillOsenkov

See also:

Remarks:

  1. To be verified 

  2. .NET DLL required 

  3. To be verified 

  4. .NET app must be launched