LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Ilasm.exe

View source

used for compile c# code into dll or exe.

Compile
02COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

Compile2

EXAMPLE 01T1127

Binary file used by .NET to compile C#/intermediate (IL) code to .exe

COMMAND
ilasm.exe {PATH_ABSOLUTE:.txt} /exe
USE CASE
Compile attacker code on system. Bypass defensive counter measures.
PRIVILEGES
User
OPERATING SYSTEM
Windows 7, Windows 10, Windows 11
EXAMPLE 02T1127

Binary file used by .NET to compile C#/intermediate (IL) code to dll

COMMAND
ilasm.exe {PATH_ABSOLUTE:.txt} /dll
USE CASE
A description of the usecase
PRIVILEGES
User
OPERATING SYSTEM
Windows 7, Windows 10, Windows 11
02 / ON DISK

Known paths

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    Ilasm may not be used often in production environments (such as on endpoints)

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Hai Vaknin(Lux)@VakninHai
Lior Adar