Windows Execution of Microsoft.Workflow.Compiler.exe
Flags Windows process executions of Microsoft.Workflow.Compiler.exe, a binary that may be abused for arbitrary unsigned code execution.
- Product
- windows
- Category
- process_creation
- Author
- Nik Seetharaman, frack113 (SigmaHQ), DRL 1.1
- Published
- 2019-01-16
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process creation where Microsoft.Workflow.Compiler.exe is executed on Windows. Attackers may abuse workflow compilation features to run arbitrary code without requiring properly signed payloads. It relies on process creation telemetry capturing the executable image path ending with Microsoft.Workflow.Compiler.exe and the OriginalFileName field.
Reporting behind it
- posts.specterops.iohttps://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/Binaries/Microsoft.Workflow.Compiler/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_microsoft_workflow_compiler_execution.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Execution of Microsoft.Workflow.Compiler.exe
id: cb615d08-b592-4e1f-ba26-33f33277a2ad
status: test
description: This rule identifies process creation where Microsoft.Workflow.Compiler.exe is executed on Windows. Attackers may abuse workflow compilation features to run arbitrary code without requiring properly signed payloads. It relies on process creation telemetry capturing the executable image path ending with Microsoft.Workflow.Compiler.exe and the OriginalFileName field.
references:
- https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md
- https://lolbas-project.github.io/lolbas/Binaries/Microsoft.Workflow.Compiler/
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_microsoft_workflow_compiler_execution.yml
author: Nik Seetharaman, frack113, Huntrule Team
date: 2019-01-16
modified: 2023-02-03
tags:
- attack.execution
- attack.stealth
- attack.t1127
- attack.t1218
- detection.threat-hunting
logsource:
category: process_creation
product: windows
detection:
selection:
- Image|endswith: \Microsoft.Workflow.Compiler.exe
- OriginalFileName: Microsoft.Workflow.Compiler.exe
condition: selection
falsepositives:
- Legitimate MWC use (unlikely in modern enterprise environments)
level: medium
license: DRL-1.1
related:
- id: 419dbf2b-8a9b-4bea-bf99-7544b050ec8d
type: derived