Windows Process Execution of aspnet_compiler.exe from Suspicious Paths

title: Windows Process Execution of aspnet_compiler.exe from Suspicious Paths
id: 783d95f0-a6d2-45ce-814a-7757ad2e463f
related:
  - id: 9ccba514-7cb6-4c5c-b377-700758f2f120
    type: similar
  - id: 4c7f49ee-2638-43bb-b85b-ce676c30b260
    type: similar
  - id: a01b8329-5953-4f73-ae2d-aa01e1f35f00
    type: similar
  - id: 9f50fe98-fe5c-4a2d-86c7-fad7f63ed622
    type: derived
status: test
description: This rule flags Windows process creation events where aspnet_compiler.exe is executed from potentially suspicious locations. Attackers may abuse legitimate .NET tooling to compile or stage payloads while blending in with normal Windows execution patterns. The detection relies on process creation telemetry, using the executable path and command line contents to identify uncommon user-writable and task-related directories.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Aspnet_Compiler/
  - https://ijustwannared.team/2020/08/01/the-curious-case-of-aspnet_compiler-exe/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_aspnet_compiler_susp_paths.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-08-14
modified: 2025-02-24
tags:
  - attack.execution
  - attack.stealth
  - attack.t1127
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains:
      - :\Windows\Microsoft.NET\Framework\
      - :\Windows\Microsoft.NET\Framework64\
      - :\Windows\Microsoft.NET\FrameworkArm\
      - :\Windows\Microsoft.NET\FrameworkArm64\
    Image|endswith: \aspnet_compiler.exe
    CommandLine|contains:
      - \Users\Public\
      - \AppData\Local\Temp\
      - \AppData\Local\Roaming\
      - :\Temp\
      - :\Windows\Temp\
      - :\Windows\System32\Tasks\
      - :\Windows\Tasks\
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1