# Abusing and Detecting LOLBIN Usage of .NET Development Mode Features

DevFeed: [Abusing and Detecting LOLBIN Usage of .NET Development Mode Features](<https://devfeed.tech/articles/abusing-and-detecting-lolbin-usage-of-net-development-mode-features-20501.md>)

Original publisher: [Read original article](<https://bohops.com/2021/05/30/abusing-and-detecting-lolbin-usage-of-net-development-mode-features/>)

Author: bohops

Published: 2021-05-30T16:24:30Z

Content type: tutorial

Language: en

Sources: [Bohops](<https://devfeed.tech/sources/bohops.md>)

Topics: [.NET](<https://devfeed.tech/topics/net.md>), [configuration](<https://devfeed.tech/topics/configuration.md>), [Environment Variables](<https://devfeed.tech/topics/environment-variables.md>), [Development](<https://devfeed.tech/topics/development.md>), [Filesystems](<https://devfeed.tech/topics/filesystems.md>), [Windows](<https://devfeed.tech/topics/windows.md>)

Tags: [configuration](<https://devfeed.tech/tags/configuration.md>), [debugging](<https://devfeed.tech/tags/debugging.md>), [development](<https://devfeed.tech/tags/development.md>), [environment-variables](<https://devfeed.tech/tags/environment-variables.md>), [files](<https://devfeed.tech/tags/files.md>), [microsoft](<https://devfeed.tech/tags/microsoft.md>), [net](<https://devfeed.tech/tags/net.md>), [uncategorized](<https://devfeed.tech/tags/uncategorized.md>), [windows](<https://devfeed.tech/tags/windows.md>)

## AI overview

This article explains how .NET development-mode configuration can be abused to turn executables into living-off-the-land binaries by overriding Global Assembly Cache path lookups. It also discusses defensive detection considerations and shows the roles of configuration files and the DEVPATH environment variable.

## Source excerpt

Background As discussed in this previous post, Microsoft has provided valuable (explicit and implicit) insight into the inner workings of the functional components of the .NET ecosystem through online documentation and by open-sourcing .NET Core. .NET, in general, is a very powerful and capable development platform and runtime framework for building and running .NET managed [...]