Windows: Detect w3wp.exe launching csc.exe for Dynamic Compilation (MOVEit CVE-2023-34362)
Flags IIS (w3wp.exe) spawning csc.exe within a MOVEit pool, consistent with dynamic compilation activity.
- Product
- windows
- Category
- process_creation
- Author
- @kostastsale (SigmaHQ), DRL 1.1
- Published
- 2023-06-01
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process creation where IIS worker processes (w3wp.exe) launch the C# compiler (csc.exe) as part of dynamic compilation behavior associated with MOVEit exploitation. Attackers may use this to compile and deploy malicious DLLs under the ASP.NET temporary compilation directories. Detection relies on Windows process creation telemetry capturing parent process image/command line and the executed child image path.
Reporting behind it
- huntress.comhttps://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response
- trustedsec.comhttps://www.trustedsec.com/blog/critical-vulnerability-in-progress-moveit-transfer-technical-analysis-and-recommendations/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-34362-MOVEit-Transfer-Exploit/proc_creation_win_exploit_cve_2023_34362_moveit_transfer_exploitation_activity.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Detect w3wp.exe launching csc.exe for Dynamic Compilation (MOVEit CVE-2023-34362)"
id: 964beeed-04ff-42b9-b6ad-a3080c87d451
status: test
description: This rule identifies process creation where IIS worker processes (w3wp.exe) launch the C# compiler (csc.exe) as part of dynamic compilation behavior associated with MOVEit exploitation. Attackers may use this to compile and deploy malicious DLLs under the ASP.NET temporary compilation directories. Detection relies on Windows process creation telemetry capturing parent process image/command line and the executed child image path.
references:
- https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response
- https://www.trustedsec.com/blog/critical-vulnerability-in-progress-moveit-transfer-technical-analysis-and-recommendations/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-34362-MOVEit-Transfer-Exploit/proc_creation_win_exploit_cve_2023_34362_moveit_transfer_exploitation_activity.yml
author: "@kostastsale, Huntrule Team"
date: 2023-06-01
tags:
- attack.execution
- attack.t1059
- cve.2023-34362
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \w3wp.exe
ParentCommandLine|contains: moveitdmz pool
Image|endswith: \csc.exe
condition: selection
falsepositives:
- Initial software installation and software updates.
level: medium
license: DRL-1.1
related:
- id: 39ac1fb0-07f1-474b-b97e-c5c0eace0d79
type: derived