Windows Execution of Microsoft.Workflow.Compiler.exe

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1127Trusted Developer Utilities Proxy Execution
Persistence
Priv Esc
Defense Evasion
- T1127Trusted Developer Utilities Proxy Execution
- T1218System Binary Proxy Execution
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies process creation where Microsoft.Workflow.Compiler.exe is executed on Windows. Attackers may abuse workflow compilation features to run arbitrary code without requiring properly signed payloads. It relies on process creation telemetry capturing the executable image path ending with Microsoft.Workflow.Compiler.exe and the OriginalFileName field.

Reporting behind it

Related detections9 linkedT1218 — drag to rearrange

Windows: Suspicious Cdb.EXE Proxy Execution via Debugger Script Parameters

Suspicious More_eggs ie4uinit Copy to AppData Microsoft Folder

Suspicious Microsoft.NodejsTools.PressAnyKey LOLBAS Proxy Execution

Suspicious Renamed Windows Debugger CDB Execution

Suspicious Scripting Interpreter Execution From Downloads Or Temp via Reputation Hijacking

Suspicious MMC Console Spawning Script Interpreter via GrimResource

Suspicious MMC Console Loading MSC File From User Writable Path

Suspicious Cabinet Extraction of Masqueraded vstm Archive via extrac32

Suspicious Code Compilation via Aspnet_compiler LOLBIN (via process_creation)

Windows Execution of Microsoft.Workflow.Compiler.exe

Pivot detection · T1218 · 9 related

Changelog

v5

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-execution-of-microsoft-workflow-compiler-exe-419dbf2b

title: Windows Execution of Microsoft.Workflow.Compiler.exe
id: cb615d08-b592-4e1f-ba26-33f33277a2ad
status: test
description: This rule identifies process creation where Microsoft.Workflow.Compiler.exe is executed on Windows. Attackers may abuse workflow compilation features to run arbitrary code without requiring properly signed payloads. It relies on process creation telemetry capturing the executable image path ending with Microsoft.Workflow.Compiler.exe and the OriginalFileName field.
references:
  - https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md
  - https://lolbas-project.github.io/lolbas/Binaries/Microsoft.Workflow.Compiler/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_microsoft_workflow_compiler_execution.yml
author: Nik Seetharaman, frack113, Huntrule Team
date: 2019-01-16
modified: 2023-02-03
tags:
  - attack.execution
  - attack.stealth
  - attack.t1127
  - attack.t1218
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: \Microsoft.Workflow.Compiler.exe
    - OriginalFileName: Microsoft.Workflow.Compiler.exe
  condition: selection
falsepositives:
  - Legitimate MWC use (unlikely in modern enterprise environments)
level: medium
license: DRL-1.1
related:
  - id: 419dbf2b-8a9b-4bea-bf99-7544b050ec8d
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL