Microsoft Workflow Compiler Execution
Detects the execution of Microsoft Workflow Compiler (Microsoft.Workflow.Compiler.exe), which can be abused to execute arbitrary unsigned code. This utility is part of the .NET Framework and can compile and execute workflow definition files. Adversaries may leverage this for defense evasion and execution by proxying malicious code through a trusted, signed binary.
Sigma
