Windows: aspnet_compiler.exe Execution Detection

Detects execution of aspnet_compiler.exe from Windows .NET Framework directories, which can be abused to compile and run C#.

FreeReviewedSigma · Medium · v2

Product: windows
Category: process_creation
Author: frack113 (SigmaHQ), DRL 1.1
Published: 2021-11-24
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1127Trusted Developer Utilities Proxy Execution
Persistence
Priv Esc
Defense Evasion
- T1127Trusted Developer Utilities Proxy Execution
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creation where the executable is aspnet_compiler.exe located under the Windows .NET Framework or Framework64/Arm paths. Attackers can abuse aspnet_compiler to compile code as part of execution chains, making this a relevant indicator of suspicious activity. Telemetry relies on Windows process creation events that include the process Image path.

Reporting behind it

Related detections9 linkedT1127 — drag to rearrange

Suspicious Code Compilation via Aspnet_compiler LOLBIN (via process_creation)

ArcSOC.exe Creates Suspicious Script/Executable Files on Windows

Suspicious Child Process of aspnet_compiler.exe on Windows

Suspicious aspnet_compiler.exe Execution from User or Temp Paths on Windows

Windows: Detect kavremover-related LOLBIN command-line usage

Windows node.exe Execution with -e/--eval and suspicious child process usage

Windows: Process creation involving VSIISExeLauncher.exe with -p and -a arguments

Windows Process Creation: Mftrace.exe Child Process Execution

Windows Process Creation: Remote.exe Execution

Windows: aspnet_compiler.exe Execution Detection

Pivot detection · T1127 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-aspnet-compiler-exe-execution-via-net-framework-paths-a01b8329

title: "Windows: aspnet_compiler.exe Execution Detection"
id: 75d5aec8-d8e8-4ac8-8f46-c86c099b402b
related:
  - id: 9ccba514-7cb6-4c5c-b377-700758f2f120
    type: similar
  - id: 4c7f49ee-2638-43bb-b85b-ce676c30b260
    type: similar
  - id: 9f50fe98-fe5c-4a2d-86c7-fad7f63ed622
    type: similar
  - id: a01b8329-5953-4f73-ae2d-aa01e1f35f00
    type: derived
status: test
description: This rule flags process creation where the executable is aspnet_compiler.exe located under the Windows .NET Framework or Framework64/Arm paths. Attackers can abuse aspnet_compiler to compile code as part of execution chains, making this a relevant indicator of suspicious activity. Telemetry relies on Windows process creation events that include the process Image path.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Aspnet_Compiler/
  - https://ijustwannared.team/2020/08/01/the-curious-case-of-aspnet_compiler-exe/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_aspnet_compiler_exectuion.yml
author: frack113, Huntrule Team
date: 2021-11-24
modified: 2025-02-24
tags:
  - attack.execution
  - attack.stealth
  - attack.t1127
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains:
      - :\Windows\Microsoft.NET\Framework\
      - :\Windows\Microsoft.NET\Framework64\
      - :\Windows\Microsoft.NET\FrameworkArm\
      - :\Windows\Microsoft.NET\FrameworkArm64\
    Image|endswith: \aspnet_compiler.exe
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL