MalCommands — microsoft.workflow.compiler

#					tactics	techniques	os

detail

Command Line

Microsoft.Workflow.Compiler.exe tests.xml results.xml

Description

Abuse Microsoft Workflow Compiler to execute C# or VB.net code stored in an XOML file and referenced from within tests.xml.

Risk

High

Risk Reason

For most users except developers, this is a suspicious activity.

Fidelity

High

Fidelity Reason

For most users except developers, this is typically a very rare action.

Operating Systems

Windows

Killchain Phases

Actions on Objectives

References

TOOL DATA

Tool Name: Microsoft.Workflow.Compiler

Tool URL: https://learn.microsoft.com/en-us/dotnet/framework/windows-workflow-foundation/wfc-exe-workflow-compiler-tool

Tool Description: Microsoft Workflow Compiler is a Microsoft .NET utility capable of compiling and executing C# or VisualBasic .NET source code.

Common Tool Locations

C:\Windows\Microsoft.Net\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe

Common Tool Arguments

/target - Specify whether an assembly or exe should be created.
/out - Output file name
/debug - Emit full debugging information

MITRE ATT&CK TECHNIQUES

Technique: T1127 - Trusted Developer Utilities Proxy Execution

URL: https://attack.mitre.org/techniques/T1127

Description: Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads. There are many utilities used for software development related tasks that can be used to execute code in various forms to assist in development, debugging, and reverse engineering.(Citation: engima0x3 DNX Bypass)(Citation: engima0x3 RCSI Bypass)(Citation: Exploit Monday WinDbg)(Citation: LOLBAS Tracker) These utilities may often be signed with legitimate certificates that allow them to execute on a system and proxy execution of malicious code through a trusted process that effectively bypasses application control solutions.

Tactics:

Defense Evasion