Potentially Suspicious ASP.NET Compilation Via AspNetCompiler

SigmaHQ Detections@sigmaHQ

•updated Jun 4, 2025•1•0•16

Detects the execution of "aspnet_compiler.exe" when it attempts to compile files from potentially suspicious or user-writable directories. This behavior can indicate an adversary using a trusted developer utility for defense evasion or to execute malicious code.