Assembly DLL Creation Via AspNetCompiler

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•23

Detects the creation of new DLL assembly files by "aspnet_compiler.exe" within the 'Temporary ASP.NET Files' directory, specifically in the 'assembly\tmp\' subdirectory. This activity could indicate abuse of "aspnet_compiler" to proxy execution through a build provider, potentially for malicious purposes.