Suspicious aspnet_compiler.exe Execution from User or Temp Paths on Windows

Alerts when aspnet_compiler.exe runs with command lines indicating user-writable or temp/task paths.

FreeReviewedSigma · High · v2

Product: windows
Category: process_creation
Author: Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2023-08-14
Updated: 2026-07-31

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1127Trusted Developer Utilities Proxy Execution
Persistence
Priv Esc
Defense Evasion
- T1127Trusted Developer Utilities Proxy Execution
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creation events where aspnet_compiler.exe is launched from common Microsoft .NET Framework directories, with command lines containing potentially suspicious path locations. Attackers may use legitimate .NET tooling to blend in with normal system activity while performing compilation or staging in writable user-controlled directories. The detection relies on Windows process creation telemetry, matching the executable path suffix and the presence of specific suspicious path strings in the command line.

Reporting behind it

Related detections9 linkedT1127 — drag to rearrange

Suspicious Code Compilation via Aspnet_compiler LOLBIN (via process_creation)

ArcSOC.exe Creates Suspicious Script/Executable Files on Windows

Suspicious Child Process of aspnet_compiler.exe on Windows

Windows: Detect kavremover-related LOLBIN command-line usage

Windows node.exe Execution with -e/--eval and suspicious child process usage

Windows: Process creation involving VSIISExeLauncher.exe with -p and -a arguments

Windows Process Creation: Mftrace.exe Child Process Execution

Windows Process Creation: Remote.exe Execution

Windows Process Creation: wfc.exe Execution for Workflow Command-line Compiler Abuse

Suspicious aspnet_compiler.exe Execution from User or Temp Paths on Windows

Pivot detection · T1127 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-execution-of-aspnet-compiler-exe-from-suspicious-paths-9f50fe98

title: Suspicious aspnet_compiler.exe Execution from User or Temp Paths on Windows
id: 783d95f0-a6d2-45ce-814a-7757ad2e463f
related:
  - id: 9ccba514-7cb6-4c5c-b377-700758f2f120
    type: similar
  - id: 4c7f49ee-2638-43bb-b85b-ce676c30b260
    type: similar
  - id: a01b8329-5953-4f73-ae2d-aa01e1f35f00
    type: similar
  - id: 9f50fe98-fe5c-4a2d-86c7-fad7f63ed622
    type: derived
status: test
description: This rule flags process creation events where aspnet_compiler.exe is launched from common Microsoft .NET Framework directories, with command lines containing potentially suspicious path locations. Attackers may use legitimate .NET tooling to blend in with normal system activity while performing compilation or staging in writable user-controlled directories. The detection relies on Windows process creation telemetry, matching the executable path suffix and the presence of specific suspicious path strings in the command line.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Aspnet_Compiler/
  - https://ijustwannared.team/2020/08/01/the-curious-case-of-aspnet_compiler-exe/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_aspnet_compiler_susp_paths.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-08-14
modified: 2025-02-24
tags:
  - attack.execution
  - attack.stealth
  - attack.t1127
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains:
      - :\Windows\Microsoft.NET\Framework\
      - :\Windows\Microsoft.NET\Framework64\
      - :\Windows\Microsoft.NET\FrameworkArm\
      - :\Windows\Microsoft.NET\FrameworkArm64\
    Image|endswith: \aspnet_compiler.exe
    CommandLine|contains:
      - \Users\Public\
      - \AppData\Local\Temp\
      - \AppData\Local\Roaming\
      - :\Temp\
      - :\Windows\Temp\
      - :\Windows\System32\Tasks\
      - :\Windows\Tasks\
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL