MalCommands — aspnet

#					tactics	techniques	os

detail

Command Line

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe -v none -p C:\users\cpl.internal\desktop\asptest\ -f C:\users\cpl.internal\desktop\asptest\none -u

Description

Cyber threats may utilize aspnet_compiler to run arbitrary C# code, potentially evading certain detection mechanisms.

Risk

High

Risk Reason

This type of usage is fairly uncommon (except for potential developer groups) - seeing a normal user execute a commandline involving aspnet_compiler is suspicious.

Fidelity

High

Fidelity Reason

Alerting on the usage of this utility should not cause a significant amount of false positives once appropriate tuning is performed to exclude developer-type users.

Operating Systems

Windows

Killchain Phases

Actions on Objectives
Exploitation
Installation

References

TOOL DATA

Tool Name: aspnet_compiler

Tool URL: https://learn.microsoft.com/en-us/previous-versions/ms229863(v=vs.140)?redirectedfrom=MSDN

Tool Description: The ASP.NET Compilation Tool (aspnet_compiler.exe) enables teams to compile an ASP.NET web application. This can help to improve performance but also can be abused by threat actors for on-the-fly execution of C# source code.

Common Tool Locations

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

Common Tool Arguments

v - Specify the virtual path of the application to be compiled.
p - Value of the accompanying physicalPath parameter to locate the to-be-compiled application.
f - Overwrite existing files in targetDir
targetDir - Network or Local disk that will contain the compiled application.
c - Specifies that the application should be fully rebuilt.

MITRE ATT&CK TECHNIQUES

Technique: T1127 - Trusted Developer Utilities Proxy Execution

URL: https://attack.mitre.org/techniques/T1127

Description: Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads. There are many utilities used for software development related tasks that can be used to execute code in various forms to assist in development, debugging, and reverse engineering.(Citation: engima0x3 DNX Bypass)(Citation: engima0x3 RCSI Bypass)(Citation: Exploit Monday WinDbg)(Citation: LOLBAS Tracker) These utilities may often be signed with legitimate certificates that allow them to execute on a system and proxy execution of malicious code through a trusted process that effectively bypasses application control solutions.

Tactics:

Defense Evasion