Identifier / Programs / Windows

ilasm.exe

Microsoft .NET Framework IL assembler file version info (xCyclopedia)

LOLBAS Compile 1 Sigma rule name it 1 ATT&CK technique 2 documented commands 4 known copies with hashes

How ilasm.exe is abused

documented by LOLBAS

Compile T1127 Trusted Developer Utilities Proxy Execution

-exe

Compile T1127 Trusted Developer Utilities Proxy Execution

-dll

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for ilasm.exe.

2 documented commands

from LOLBAS, each read by the identifier

Compile T1127 Trusted Developer Utilities Proxy Execution User privileges

Binary file used by .NET to compile C#/intermediate (IL) code to .exe

ilasm.exe {PATH_ABSOLUTE:.txt} /exe

Identify

Trips 1 Sigma rule: mediumC# IL Code Compilation Via Ilasm.EXE by frack113, Nasreddine Bencherchali (Nextron Systems)

Compile T1127 Trusted Developer Utilities Proxy Execution User privileges

Binary file used by .NET to compile C#/intermediate (IL) code to dll

ilasm.exe {PATH_ABSOLUTE:.txt} /dll

Identify

Trips 1 Sigma rule: mediumC# IL Code Compilation Via Ilasm.EXE by frack113, Nasreddine Bencherchali (Nextron Systems)

All 2 commands the identifier reads trip a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for ilasm.exe, by Hai vaknin (lux), at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for ilasm.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

mediumC# IL Code Compilation Via Ilasm.EXEfrack113, Nasreddine Bencherchali (Nextron Systems)

T1127Trusted Developer Utilities Proxy Execution

Is it the real ilasm.exe?

file version info and known copies

Installed inC:\Windows\Microsoft.NET\Framework64\v4.0.30319\
C:\Windows\Microsoft.NET\Framework\v4.0.30319\

Signed byMicrosoft Windows

ProductMicrosoft .NET Framework, Microsoft Corporation

DescriptionMicrosoft .NET Framework IL assembler

4 known copies

4.8.4161.0 built by: NET48REL1 · C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe · signed by Microsoft Windows

486be223bcf745332cb86a2b0bb3399e5bc89fc2c31c4b3ac6a9ea13cf82fb3f

4.8.4161.0 built by: NET48REL1 · C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\ilasm.exe · signed by Microsoft Windows

8187cb164a61cf4fc4a4f68955f4d3c55c322f7509fc1dbc9b02b2b9feeecd57

4.8.4084.0 built by: NET48REL1 · C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe · signed by Microsoft Windows

2bd4200161fc147790022f47f90a2e08a2e058bb8269d7d4035d5d46deffce6a

4.8.4084.0 built by: NET48REL1 · C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe · signed by Microsoft Windows

584dbdaa56a351bd6ec6e02165060bcfab6e6b572ff8e3e694d4b3f90475aac9

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.