Windows: Detect aspnet_compiler.exe Creating Temporary Assembly DLLs
Alerts when aspnet_compiler.exe writes a new DLL into the Temporary ASP.NET assembly tmp directories.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-08-14
- Updated
- 2026-07-31
What it detects
This rule identifies creation of new DLL files when the process name ends with aspnet_compiler.exe and the target path matches temporary ASP.NET assembly locations. Attackers may use aspnet_compiler abuse to generate assemblies as part of proxy-style execution or deployment workflows. The detection relies on Windows file event telemetry capturing the creating process image and the target filename/path.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-new-dll-created-by-aspnet-compiler-exe-in-temporary-asp-net-assembly-pat-4c7f49ee
title: "Windows: Detect aspnet_compiler.exe Creating Temporary Assembly DLLs"
id: a010941b-7a1d-4410-b9e6-2fceeed7d418
related:
- id: 9ccba514-7cb6-4c5c-b377-700758f2f120
type: similar
- id: 9f50fe98-fe5c-4a2d-86c7-fad7f63ed622
type: similar
- id: a01b8329-5953-4f73-ae2d-aa01e1f35f00
type: similar
- id: 4c7f49ee-2638-43bb-b85b-ce676c30b260
type: derived
status: test
description: This rule identifies creation of new DLL files when the process name ends with aspnet_compiler.exe and the target path matches temporary ASP.NET assembly locations. Attackers may use aspnet_compiler abuse to generate assemblies as part of proxy-style execution or deployment workflows. The detection relies on Windows file event telemetry capturing the creating process image and the target filename/path.
references:
- Internal Research
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_aspnet_temp_files.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-08-14
tags:
- attack.execution
logsource:
product: windows
category: file_event
detection:
selection:
Image|endswith: \aspnet_compiler.exe
TargetFilename|contains|all:
- \Temporary ASP.NET Files\
- \assembly\tmp\
- .dll
condition: selection
falsepositives:
- Legitimate assembly compilation using a build provider
level: medium
license: DRL-1.1