LokiBot Process Injection - aspnet_compiler.exe Outbound Network Connection

Duo Tech@duotech

•updated Jun 30, 2026•0•0•0

Detects outbound network connections from the aspnet_compiler.exe process. This process is often abused by malware like LokiBot as a host for malicious payloads through process injection to establish C2 communication, as it has no legitimate need for external network connectivity.