attack.t1127

AspNetCompiler Execution

Apr 28, 2026 · attack.execution attack.stealth attack.t1127 ·

Share on:

Detects execution of "aspnet_compiler.exe" which can be abused to compile and execute C# code.

C# IL Code Compilation Via Ilasm.EXE

Apr 28, 2026 · attack.execution attack.stealth attack.t1127 ·

Share on:

Detects the use of "Ilasm.EXE" in order to compile C# intermediate (IL) code to EXE or DLL.

Detection of PowerShell Execution via Sqlps.exe

Apr 28, 2026 · attack.execution attack.stealth attack.t1059.001 attack.t1127 ·

Share on:

This rule detects execution of a PowerShell code through the sqlps.exe utility, which is included in the standard set of utilities supplied with the MSSQL Server. Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.

JScript Compiler Execution

Apr 28, 2026 · attack.execution attack.stealth attack.t1127 ·

Share on:

Detects the execution of the "jsc.exe" (JScript Compiler). Attacker might abuse this in order to compile JScript files on the fly and bypassing application whitelisting.

Kavremover Dropped Binary LOLBIN Usage

Apr 28, 2026 · attack.execution attack.stealth attack.t1127 ·

Share on:

Detects the execution of a signed binary dropped by Kaspersky Lab Products Remover (kavremover) which can be abused as a LOLBIN to execute arbitrary commands and binaries.

Node Process Executions

Apr 28, 2026 · attack.execution attack.stealth attack.t1127 attack.t1059.007 ·

Share on:

Detects the execution of other scripts using the Node executable packaged with Adobe Creative Cloud

Potential Arbitrary Code Execution Via Node.EXE

Apr 28, 2026 · attack.execution attack.stealth attack.t1127 ·

Share on:

Detects the execution node.exe which is shipped with multiple software such as VMware, Adobe...etc. In order to execute arbitrary code. For example to establish reverse shell as seen in Log4j attacks...etc

Potential Binary Proxy Execution Via Cdb.EXE

Apr 28, 2026 · attack.execution attack.stealth attack.t1106 attack.t1218 attack.t1127 ·

Share on:

Detects usage of "cdb.exe" to launch arbitrary processes or commands from a debugger script file

Potential Mftrace.EXE Abuse

Apr 28, 2026 · attack.execution attack.stealth attack.t1127 ·

Share on:

Detects child processes of the "Trace log generation tool for Media Foundation Tools" (Mftrace.exe) which can abused to execute arbitrary binaries.

Potentially Suspicious ASP.NET Compilation Via AspNetCompiler

Apr 28, 2026 · attack.execution attack.stealth attack.t1127 ·

Share on:

Detects execution of "aspnet_compiler.exe" with potentially suspicious paths for compilation.

Remote Thread Creation Ttdinject.exe Proxy

Apr 28, 2026 · attack.execution attack.stealth attack.t1127 ·

Share on:

Detects a remote thread creation of Ttdinject.exe used as proxy

SQL Client Tools PowerShell Session Detection

Apr 28, 2026 · attack.execution attack.stealth attack.t1059.001 attack.t1127 ·

Share on:

This rule detects execution of a PowerShell code through the sqltoolsps.exe utility, which is included in the standard set of utilities supplied with the Microsoft SQL Server Management studio. Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.

Suspicious Child Process of AspNetCompiler

Apr 28, 2026 · attack.execution attack.stealth attack.t1127 ·

Share on:

Detects potentially suspicious child processes of "aspnet_compiler.exe".

Suspicious File Created by ArcSOC.exe

Apr 28, 2026 · attack.command-and-control attack.persistence attack.initial-access attack.execution attack.stealth attack.t1127 attack.t1105 attack.t1133 ·

Share on:

Detects instances where the ArcGIS Server process ArcSOC.exe, which hosts REST services running on an ArcGIS server, creates a file with suspicious file type, indicating that it may be an executable, script file, or otherwise unusual.

Suspicious Use of CSharp Interactive Console

Apr 28, 2026 · attack.execution attack.stealth attack.t1127 ·

Share on:

Detects the execution of CSharp interactive console by PowerShell

Use of Remote.exe

Apr 28, 2026 · attack.execution attack.stealth attack.t1127 ·

Share on:

Remote.exe is part of WinDbg in the Windows SDK and can be used for AWL bypass and running remote files.

Use of TTDInject.exe

Apr 28, 2026 · attack.execution attack.stealth attack.t1127 ·

Share on:

Detects the executiob of TTDInject.exe, which is used by Windows 10 v1809 and newer to debug time travel (underlying call of tttracer.exe)

Use of VSIISExeLauncher.exe

Apr 28, 2026 · attack.execution attack.stealth attack.t1127 ·

Share on:

The "VSIISExeLauncher.exe" binary part of the Visual Studio/VS Code can be used to execute arbitrary binaries

Use of Wfc.exe

Apr 28, 2026 · attack.execution attack.stealth attack.t1127 ·

Share on:

The Workflow Command-line Compiler can be used for AWL bypass and is listed in Microsoft's recommended block rules.

ArcSOC.exe Creating Suspicious Files

Nov 25, 2025 · attack.defense-evasion attack.command-and-control attack.persistence attack.t1127 attack.t1105 attack.t1133 ·

Share on:

Detects instances where the ArcGIS Server process ArcSOC.exe, which hosts REST services running on an ArcGIS server, creates files with suspicious file types, indicating that they may be executables, script files, or otherwise unusual.