LOL · Binary

Ilasm.exe

2 techniquesWindowsLOLBASGPL-3.0

Compile

CompileWindows

Binary file used by .NET to compile C#/intermediate (IL) code to .exe

Use Compile attacker code on system. Bypass defensive counter measures.

ilasm.exe {PATH_ABSOLUTE:.txt} /exe

Evidence: Upstream reference
Environment: Local host
Context: user
Native: Compile
MITRE: T1127
Detection: IOC: Ilasm may not be used often in production environments (such as on endpoints)
Sigma: github.com/SigmaHQ/sigma/blob/bea6f18d350d9c9fdc067f93dde0e9b11cc22dc2/rules/windows/process_creation/proc_creation_win_lolbin_ilasm.yml
Refs: github.com/LuxNoBulIshit/BeforeCompileBy-ilasm/blob/master/hello_world.txt
lolbas-project.github.io/lolbas/Binaries/Ilasm/

CompileWindows

Binary file used by .NET to compile C#/intermediate (IL) code to dll

Use A description of the usecase

ilasm.exe {PATH_ABSOLUTE:.txt} /dll

Evidence: Upstream reference
Environment: Local host
Context: user
Native: Compile
MITRE: T1127
Detection: IOC: Ilasm may not be used often in production environments (such as on endpoints)
Sigma: github.com/SigmaHQ/sigma/blob/bea6f18d350d9c9fdc067f93dde0e9b11cc22dc2/rules/windows/process_creation/proc_creation_win_lolbin_ilasm.yml
Refs: github.com/LuxNoBulIshit/BeforeCompileBy-ilasm/blob/master/hello_world.txt
lolbas-project.github.io/lolbas/Binaries/Ilasm/