Windows Process Creation: Ilasm.EXE Used to Compile IL to EXE/DLL

Alerts when Ilasm.EXE is run with /exe or /dll to compile IL into a Windows binary.

FreeReviewedSigma · Medium · v2

Product: windows
Category: process_creation
Author: frack113, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2022-05-07
Updated: 2026-07-31

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1127Trusted Developer Utilities Proxy Execution
Persistence
Priv Esc
Defense Evasion
- T1127Trusted Developer Utilities Proxy Execution
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies instances of Ilasm.EXE being executed with command-line arguments indicating IL compilation into an EXE or DLL. Attackers may use this to build .NET assemblies from intermediate language, aiding stealthy payload preparation or custom tooling. Detection relies on Windows process creation telemetry fields such as Image (path ending in \ilasm.exe), OriginalFileName, and CommandLine containing /exe and/or /dll.

Reporting behind it

Related detections9 linkedT1127 — drag to rearrange

Suspicious Code Compilation via Aspnet_compiler LOLBIN (via process_creation)

ArcSOC.exe Creates Suspicious Script/Executable Files on Windows

Suspicious Child Process of aspnet_compiler.exe on Windows

Suspicious aspnet_compiler.exe Execution from User or Temp Paths on Windows

Windows: Detect kavremover-related LOLBIN command-line usage

Windows node.exe Execution with -e/--eval and suspicious child process usage

Windows: Process creation involving VSIISExeLauncher.exe with -p and -a arguments

Windows Process Creation: Mftrace.exe Child Process Execution

Windows Process Creation: Remote.exe Execution

Windows Process Creation: Ilasm.EXE Used to Compile IL to EXE/DLL

Pivot detection · T1127 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-ilasm-exe-compiling-c-il-to-exe-or-dll-850d55f9

title: "Windows Process Creation: Ilasm.EXE Used to Compile IL to EXE/DLL"
id: d2e37ace-38e8-4fae-83d3-1ac035301aa9
status: test
description: This rule identifies instances of Ilasm.EXE being executed with command-line arguments indicating IL compilation into an EXE or DLL. Attackers may use this to build .NET assemblies from intermediate language, aiding stealthy payload preparation or custom tooling. Detection relies on Windows process creation telemetry fields such as Image (path ending in \ilasm.exe), OriginalFileName, and CommandLine containing /exe and/or /dll.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Ilasm/
  - https://www.echotrail.io/insights/search/ilasm.exe
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_ilasm_il_code_compilation.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-05-07
modified: 2022-05-16
tags:
  - attack.execution
  - attack.stealth
  - attack.t1127
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    - Image|endswith: \ilasm.exe
    - OriginalFileName: ilasm.exe
  selection_cli:
    CommandLine|contains:
      - " /dll"
      - " /exe"
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 850d55f9-6eeb-4492-ad69-a72338f65ba4
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL