Windows: Suspicious Child Processes Spawned by aspnet_compiler.exe

Alerts when aspnet_compiler.exe spawns calc/notepad or executes from public/temp/Task-related paths on Windows.

FreeUnreviewedSigmahighv1

windows-suspicious-child-processes-spawned-by-aspnet-compiler-exe-9ccba514

title: "Windows: Suspicious Child Processes Spawned by aspnet_compiler.exe"
id: de301eb0-ce44-4ef0-ade2-e0feb31953c9
related:
  - id: 4c7f49ee-2638-43bb-b85b-ce676c30b260
    type: similar
  - id: 9f50fe98-fe5c-4a2d-86c7-fad7f63ed622
    type: similar
  - id: a01b8329-5953-4f73-ae2d-aa01e1f35f00
    type: similar
  - id: 9ccba514-7cb6-4c5c-b377-700758f2f120
    type: derived
status: test
description: This rule flags process creation events where the parent process is aspnet_compiler.exe and the spawned child process matches suspicious executable names (such as calc.exe or notepad.exe) or runs from common user/temp/task locations. Attackers may abuse legitimate utilities like aspnet_compiler.exe to launch follow-on payloads or perform stealthy execution from writable paths. It relies on Windows process creation telemetry, including parent and child process image paths.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Aspnet_Compiler/
  - https://ijustwannared.team/2020/08/01/the-curious-case-of-aspnet_compiler-exe/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_aspnet_compiler_susp_child_process.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-08-14
tags:
  - attack.execution
  - attack.stealth
  - attack.t1127
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \aspnet_compiler.exe
  selection_child:
    - Image|endswith:
        - \calc.exe
        - \notepad.exe
    - Image|contains:
        - \Users\Public\
        - \AppData\Local\Temp\
        - \AppData\Local\Roaming\
        - :\Temp\
        - :\Windows\Temp\
        - :\Windows\System32\Tasks\
        - :\Windows\Tasks\
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags process creation events where the parent process is aspnet_compiler.exe and the spawned child process matches suspicious executable names (such as calc.exe or notepad.exe) or runs from common user/temp/task locations. Attackers may abuse legitimate utilities like aspnet_compiler.exe to launch follow-on payloads or perform stealthy execution from writable paths. It relies on Windows process creation telemetry, including parent and child process image paths.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.