MalCommands — ilasm

#					tactics	techniques	os

detail

Command Line

ilasm.exe C:\public\test.txt /exe

Description

Using ilasm to compile C# code directly to an EXE on a target machine (use /dll for DLL output)

Risk

Medium

Risk Reason

This type of activity is suspicious for the majority of users who are not developers but may be common for developer-type users.

Fidelity

Medium

Fidelity Reason

This is likely a rare activity for the majority of users in standard organizations.

Operating Systems

Windows

Killchain Phases

Actions on Objectives

References

https://lolbas-project.github.io/lolbas/Binaries/Ilasm/

TOOL DATA

Tool Name: ilasm

Tool URL: https://learn.microsoft.com/en-us/dotnet/framework/tools/ilasm-exe-il-assembler

Tool Description: IL Assembler (ilasm.exe) is a Microsoft utility which can generate Portable Executable (PE) files from Intermediate Language (IL) assembly (typically C#).

Common Tool Locations

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe

Common Tool Arguments

/dll - Produce a DLL instead of an EXE
/exe - Produce an EXE (default)
/include - Sets a path to search for files included with

MITRE ATT&CK TECHNIQUES

Technique: T1127 - Trusted Developer Utilities Proxy Execution

URL: https://attack.mitre.org/techniques/T1127

Description: Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads. There are many utilities used for software development related tasks that can be used to execute code in various forms to assist in development, debugging, and reverse engineering.(Citation: engima0x3 DNX Bypass)(Citation: engima0x3 RCSI Bypass)(Citation: Exploit Monday WinDbg)(Citation: LOLBAS Tracker) These utilities may often be signed with legitimate certificates that allow them to execute on a system and proxy execution of malicious code through a trusted process that effectively bypasses application control solutions.

Tactics:

Defense Evasion