Windows Process: Ilasm.EXE Compiling C# IL to EXE or DLL

title: "Windows Process: Ilasm.EXE Compiling C# IL to EXE or DLL"
id: d2e37ace-38e8-4fae-83d3-1ac035301aa9
status: test
description: This rule flags process creation events where Ilasm.EXE is executed to compile C# intermediate language (IL) into an EXE or DLL. Attackers may use IL compilation to generate binaries from intermediate code, potentially bypassing simpler detection of source-level compilation. The detection relies on Windows process creation telemetry, matching the Ilasm executable by image path/OriginalFileName and requiring command-line switches indicating output type (/exe or /dll).
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Ilasm/
  - https://www.echotrail.io/insights/search/ilasm.exe
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_ilasm_il_code_compilation.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-05-07
modified: 2022-05-16
tags:
  - attack.execution
  - attack.stealth
  - attack.t1127
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    - Image|endswith: \ilasm.exe
    - OriginalFileName: ilasm.exe
  selection_cli:
    CommandLine|contains:
      - " /dll"
      - " /exe"
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 850d55f9-6eeb-4492-ad69-a72338f65ba4
    type: derived