Ilasm.exe

type: OSBinaries

used for compile c# code into dll or exe.

Full path

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe

Commands

CompileUser T1127
Compile attacker code on system. Bypass defensive counter measures.
```
ilasm.exe {PATH_ABSOLUTE:.txt} /exe
```
Binary file used by .NET to compile C#/intermediate (IL) code to .exe
os: Windows 7, Windows 10, Windows 11
CompileUser T1127
A description of the usecase
```
ilasm.exe {PATH_ABSOLUTE:.txt} /dll
```
Binary file used by .NET to compile C#/intermediate (IL) code to dll
os: Windows 7, Windows 10, Windows 11

Detection

IOCIlasm may not be used often in production environments (such as on endpoints)
Sigma https://github.com/SigmaHQ/sigma/blob/bea6f18d350d9c9fdc067f93dde0e9b11cc22dc2/rules/windows/process_creation/proc_creation_win_lolbin_ilasm.yml

Resources

https://github.com/LuxNoBulIshit/BeforeCompileBy-ilasm/blob/master/hello_world.txt

acknowledgement: Hai Vaknin(Lux) @VakninHai, Lior Adar