Windows: New DLL created by aspnet_compiler.exe in Temporary ASP.NET assembly path

Alerts when aspnet_compiler.exe writes a new DLL into the Temporary ASP.NET assembly tmp directories.

FreeUnreviewedSigmamediumv1

windows-new-dll-created-by-aspnet-compiler-exe-in-temporary-asp-net-assembly-pat-4c7f49ee

title: "Windows: New DLL created by aspnet_compiler.exe in Temporary ASP.NET assembly path"
id: a010941b-7a1d-4410-b9e6-2fceeed7d418
related:
  - id: 9ccba514-7cb6-4c5c-b377-700758f2f120
    type: similar
  - id: 9f50fe98-fe5c-4a2d-86c7-fad7f63ed622
    type: similar
  - id: a01b8329-5953-4f73-ae2d-aa01e1f35f00
    type: similar
  - id: 4c7f49ee-2638-43bb-b85b-ce676c30b260
    type: derived
status: test
description: This rule flags file creation events where aspnet_compiler.exe creates a new DLL under the Temporary ASP.NET Files assembly tmp directory. Attackers may abuse aspnet_compiler as an execution or staging mechanism via build/provider workflows that write assemblies to these locations. The detection relies on Windows file event telemetry capturing the creating process image and the target filename path and extension.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_aspnet_temp_files.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-08-14
tags:
  - attack.execution
logsource:
  product: windows
  category: file_event
detection:
  selection:
    Image|endswith: \aspnet_compiler.exe
    TargetFilename|contains|all:
      - \Temporary ASP.NET Files\
      - \assembly\tmp\
      - .dll
  condition: selection
falsepositives:
  - Legitimate assembly compilation using a build provider
level: medium
license: DRL-1.1

What it detects

This rule flags file creation events where aspnet_compiler.exe creates a new DLL under the Temporary ASP.NET Files assembly tmp directory. Attackers may abuse aspnet_compiler as an execution or staging mechanism via build/provider workflows that write assemblies to these locations. The detection relies on Windows file event telemetry capturing the creating process image and the target filename path and extension.

Known false positives

Legitimate assembly compilation using a build provider

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.