Suspicious .NET Utility Execution by Scripting Engine

Ethan Andrews@eandrews

•updated Feb 25, 2026•6•0•53

Detects the execution of legitimate .NET framework utilities (Aspnet_compiler.exe, RegAsm.exe, vbc.exe) launched by scripting engines like PowerShell or WScript. This behavior is a known TTP for process hollowing, as seen in Agent Tesla campaigns, where malware injects its code into a trusted process to evade defenses.