Identifier / Programs / Windows
coregen.exe
Microsoft Common Language Runtime native compiler file version info (xCyclopedia)
LOLBAS Execute, AWL Bypass 2 ATT&CK techniques 3 documented commands 2 known copies with hashes
How coregen.exe is abused
Execute T1055 Process Injection
dummy_assembly_name
Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for coregen.exe.
3 documented commands
Execute T1055 Process Injection User privileges
Loads the target .DLL in arbitrary path specified with /L.
coregen.exe /L {PATH_ABSOLUTE:.dll} dummy_assembly_nameExecute T1055 Process Injection User privileges
Loads the coreclr.dll in the corgen.exe directory (e.g. C:\Program Files\Microsoft Silverlight\5.1.50918.0).
coregen.exe dummy_assembly_nameAWL Bypass T1218 System Binary Proxy Execution User privileges
Loads the target .DLL in arbitrary path specified with /L. Since binary is signed it can also be used to bypass application whitelisting solutions.
coregen.exe /L {PATH_ABSOLUTE:.dll} dummy_assembly_nameNone of the 3 commands the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for coregen.exe, by Martin Sohn Christensen, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for coregen.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
Is it the real coregen.exe?
C:\Program Files (x86)\Microsoft Silverlight\5.1.50918.0\C:\Program Files\Microsoft Silverlight\5.1.50918.0\2 known copies
5.1.50918.0 built by: SL_V5_SVC · C:\Program Files (x86)\Microsoft Silverlight\5.1.50918.0\coregen.exe · signed by Microsoft Corporation
412a6b755b2029126d46e7469854add3faa850f5a4700dd1e078fcc536ca418a5.1.50918.0 built by: SL_V5_SVC · C:\Program Files\Microsoft Silverlight\5.1.50918.0\coregen.exe · signed by Microsoft Corporation
e0344bc6c6a47d1ad11ec3ce98c48df07dc80b5f6337bbca155491ee0f814a1fFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.