Ilasm Lolbin Use Compile C-Sharp

calendar Oct 17, 2023 · attack.defense_evasion attack.t1127  ·
Share on: linkedin copy

Detect use of Ilasm.exe to compile c# code into dll or exe.

Sigma rule (View on GitHub)

 1title: Ilasm Lolbin Use Compile C-Sharp
 2id: 850d55f9-6eeb-4492-ad69-a72338f65ba4
 3status: test
 4description: Detect use of Ilasm.exe to compile c# code into dll or exe.
 5references:
 6    - https://lolbas-project.github.io/lolbas/Binaries/Ilasm/
 7    - https://www.echotrail.io/insights/search/ilasm.exe
 8author: frack113
 9date: 2022/05/07
10modified: 2022/05/16
11tags:
12    - attack.defense_evasion
13    - attack.t1127
14logsource:
15    product: windows
16    category: process_creation
17detection:
18    selection:
19        - Image|endswith: '\ilasm.exe'
20        - OriginalFileName: 'ilasm.exe'
21    condition: selection
22falsepositives:
23    - Unknown
24level: medium

References

  • Ilasm | LOLBAS

    Binary file used by .NET to compile C#/intermediate (IL) code to dll ilasm.exe C:\public\test.txt /dll Use caseA description of the usecase Privileges requiredUser Operating systemsWindows 7, Windo...


    Read More

  • EchoTrail

    Endpoint log security platform.


    Read More

Related rules

to-top