huntrule

Windows Process Creation: Ilasm.EXE Used to Compile IL to EXE/DLL

Alerts when Ilasm.EXE is run with /exe or /dll to compile IL into a Windows binary.

FreeReviewedSigma · Medium · v2
Product
windows
Category
process_creation
Author
frack113, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-05-07
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies instances of Ilasm.EXE being executed with command-line arguments indicating IL compilation into an EXE or DLL. Attackers may use this to build .NET assemblies from intermediate language, aiding stealthy payload preparation or custom tooling. Detection relies on Windows process creation telemetry fields such as Image (path ending in \ilasm.exe), OriginalFileName, and CommandLine containing /exe and/or /dll.

Reporting behind it

Related detections9 linkedT1127 — drag to rearrange
Suspicious Code Compilation via Aspnet_compiler LOLBIN (via process_creation)
ArcSOC.exe Creates Suspicious Script/Executable Files on Windows
Suspicious Child Process of aspnet_compiler.exe on Windows
Suspicious aspnet_compiler.exe Execution from User or Temp Paths on Windows
Windows: Detect kavremover-related LOLBIN command-line usage
Windows node.exe Execution with -e/--eval and suspicious child process usage
Windows: Process creation involving VSIISExeLauncher.exe with -p and -a arguments
Windows Process Creation: Mftrace.exe Child Process Execution
Windows Process Creation: Remote.exe Execution
Windows Process Creation: Ilasm.EXE Used to Compile IL to EXE/DLL
Pivot detection · T1127 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.