Windows Execution of Microsoft.Workflow.Compiler.exe

Flags Windows process executions of Microsoft.Workflow.Compiler.exe, a binary that may be abused for arbitrary unsigned code execution.

FreeUnreviewedSigmamediumv1

windows-execution-of-microsoft-workflow-compiler-exe-419dbf2b

title: Windows Execution of Microsoft.Workflow.Compiler.exe
id: cb615d08-b592-4e1f-ba26-33f33277a2ad
status: test
description: This rule identifies process creation events where Microsoft.Workflow.Compiler.exe is executed. Attackers may abuse this binary to run arbitrary unsigned code by leveraging the workflow compiler execution pathway. Telemetry required is Windows process creation logs that include the executable image path and OriginalFileName.
references:
  - https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md
  - https://lolbas-project.github.io/lolbas/Binaries/Microsoft.Workflow.Compiler/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_microsoft_workflow_compiler_execution.yml
author: Nik Seetharaman, frack113, Huntrule Team
date: 2019-01-16
modified: 2023-02-03
tags:
  - attack.execution
  - attack.stealth
  - attack.t1127
  - attack.t1218
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: \Microsoft.Workflow.Compiler.exe
    - OriginalFileName: Microsoft.Workflow.Compiler.exe
  condition: selection
falsepositives:
  - Legitimate MWC use (unlikely in modern enterprise environments)
level: medium
license: DRL-1.1
related:
  - id: 419dbf2b-8a9b-4bea-bf99-7544b050ec8d
    type: derived

What it detects

This rule identifies process creation events where Microsoft.Workflow.Compiler.exe is executed. Attackers may abuse this binary to run arbitrary unsigned code by leveraging the workflow compiler execution pathway. Telemetry required is Windows process creation logs that include the executable image path and OriginalFileName.

Known false positives

Legitimate MWC use (unlikely in modern enterprise environments)

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.