C# IL Code Compilation Via Ilasm.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•16

Detects the use of the 'Ilasm.exe' utility to compile C# Intermediate Language (IL) code into executable (EXE) or dynamic-link library (DLL) files. This activity can be indicative of an adversary compiling malicious code on a compromised system, potentially to bypass security controls or execute custom payloads.