LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Microsoft.Workflow.Compiler.exe

View source

A utility included with .NET that is capable of compiling and executing C# or VB.net code.

ExecuteAWL Bypass
03COMMAND EXAMPLES
01ATT&CK TECHNIQUES
06DETECTION RESOURCES
02CAPABILITIES
01 / TRADECRAFT

Command reference

3 examples

Execute2

EXAMPLE 01T1127

Compile and execute C# or VB.net code in a XOML file referenced in the first argument (any extension accepted).

COMMAND
Microsoft.Workflow.Compiler.exe {PATH} {PATH:.log}
USE CASE
Compile and run code
PRIVILEGES
User
OPERATING SYSTEM
Windows 10S, Windows 11
Execute · VB.NetExecute · Csharp
EXAMPLE 02T1127

Compile and execute C# or VB.net code in a XOML file referenced in the test.txt file.

COMMAND
Microsoft.Workflow.Compiler.exe {PATH} {PATH:.log}
USE CASE
Compile and run code
PRIVILEGES
User
OPERATING SYSTEM
Windows 10S, Windows 11
Execute · XOML

AWL Bypass1

EXAMPLE 01T1127

Compile and execute C# or VB.net code in a XOML file referenced in the test.txt file.

COMMAND
Microsoft.Workflow.Compiler.exe {PATH} {PATH:.log}
USE CASE
Compile and run code
PRIVILEGES
User
OPERATING SYSTEM
Windows 10S, Windows 11
Execute · XOML
02 / ON DISK

Known paths

C:\Windows\Microsoft.Net\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

6 resources

Indicators & detection notes

  • IOC

    Microsoft.Workflow.Compiler.exe would not normally be run on workstations.

  • IOC

    The presence of csc.exe or vbc.exe as child processes of Microsoft.Workflow.Compiler.exe

  • IOC

    Presence of "<CompilerInput" in a text file.

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Matt Graeber@mattifestation
John Bergbom@BergbomJohn
FortyNorth Security@FortyNorthSec
Bank Security@Bank_Security