What is the exploitation approach targeting Visual Studio using AppDomainManager?
Visual Studio C# projects include a default `App.config` file. By modifying this config to add `appDomainManagerAssembly` and `appDomainManagerType` elements, the corresponding `bin` directory config file will be updated during compilation. If a malicious `DomainManager.dll` is also placed in the `bin` folder, every time the compiled program starts, the payload executes. This allows attackers to backdoor development environments or any .NET projects built with Visual Studio. For more details, see Use AppDomainManager to maintain persistence.
Visual StudioApp.configAppDomainManager.NET projectbackdoorcompilation