Elastic Defend high stable eql

Potential Evasion via ASP.NET Compiler

Identifies the execution of the ASPNET Compiler utility to execute cshap code passed via arguments. Adversaries may abuse this utility to run malicious code.

View Source

Detection Logic

process where event.action == "start" and
 (process.name : "aspnet_compiler.exe" or process.pe.original_file_name : "aspnet_compiler.exe") and
  process.args : "-v" and process.args : "-f" and process.args : "-u" and not process.args : "-d" and
  not process.parent.executable : ("?:\\Program Files (x86)\\Microsoft Visual Studio*", "?:\\Program Files\\Microsoft Visual Studio*")

Field Validations

Loading…

Comments (0)

Loading comments...