Windows aspnet_compiler.exe Execution via .NET Framework Paths

title: Windows aspnet_compiler.exe Execution via .NET Framework Paths
id: 75d5aec8-d8e8-4ac8-8f46-c86c099b402b
related:
  - id: 9ccba514-7cb6-4c5c-b377-700758f2f120
    type: similar
  - id: 4c7f49ee-2638-43bb-b85b-ce676c30b260
    type: similar
  - id: 9f50fe98-fe5c-4a2d-86c7-fad7f63ed622
    type: similar
  - id: a01b8329-5953-4f73-ae2d-aa01e1f35f00
    type: derived
status: test
description: This rule flags process creation where the executable path ends with aspnet_compiler.exe and the image path contains one of the Windows .NET Framework directories (Framework, Framework64, FrameworkArm, or FrameworkArm64). Attackers may use aspnet_compiler.exe to compile and execute C# code, so unexpected compiler execution can indicate malicious code execution or pre-deployment behavior. Telemetry relies on Windows process creation events including the full Image path for process identification.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Aspnet_Compiler/
  - https://ijustwannared.team/2020/08/01/the-curious-case-of-aspnet_compiler-exe/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_aspnet_compiler_exectuion.yml
author: frack113, Huntrule Team
date: 2021-11-24
modified: 2025-02-24
tags:
  - attack.execution
  - attack.stealth
  - attack.t1127
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains:
      - :\Windows\Microsoft.NET\Framework\
      - :\Windows\Microsoft.NET\Framework64\
      - :\Windows\Microsoft.NET\FrameworkArm\
      - :\Windows\Microsoft.NET\FrameworkArm64\
    Image|endswith: \aspnet_compiler.exe
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1