Skip to content
Threat Feed

Tag

Compile-After-Delivery

1 brief RSS
medium advisory

Suspicious .NET Code Compilation via Unusual Parent Processes

Adversaries may use unusual parent processes to execute .NET compilers for compiling malicious code after delivery, evading security mechanisms, and this activity is detected by monitoring compiler executions initiated by scripting engines or system utilities.

Microsoft Defender XDR +3 defense-evasion compile-after-delivery windows
2r 3t