Aspnet_Compiler.exe

01 / TRADECRAFT

Command reference

1 examples

AWL Bypass1

EXAMPLE 01T1127

Execute C# code with the Build Provider and proper folder structure in place.

COMMAND

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe -v none -p C:\users\cpl.internal\desktop\asptest\ -f C:\users\cpl.internal\desktop\asptest\none -u

USE CASE: Execute proxied payload with Microsoft signed binary to bypass application control solutions
PRIVILEGES: User
OPERATING SYSTEM: Windows 10, Windows 11

02 / ON DISK

Known paths

c:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

c:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

03 / DEFENSIVE INTELLIGENCE

Detection & indicators

2 resources

BlockRulemicrosoft recommended block rulesdocs.microsoft.com
Sigmaproc_creation_win_lolbin_aspnet_compiler.ymlgithub.com

REFERENCE IMPLEMENTATIONS

Code samples

CODEBringYourOwnBuildergithub.com

Research & resources

READthe curious case of aspnet_compiler exeijustwannared.team
READsystem.web.compilation.buildprovider.generatecodedocs.microsoft.com

COMMUNITY RESEARCH

Acknowledgements

cpl@cpl3h