A utility included with .NET that is capable of compiling and executing C# or VB.net code.

Paths:

C:\Windows\Microsoft.Net\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe

Detection: Microsoft.Workflow.Compiler.exe would not normally be run on workstations. The presence of csc.exe or vbc.exe as child processes of Microsoft.Workflow.Compiler.exe Presence of “

Execute

Compile and execute C# or VB.net code in a XOML file referenced in the test.xml file.

Microsoft.Workflow.Compiler.exe tests.xml results.xml

Compile and execute C# or VB.net code in a XOML file referenced in the test.txt file.

Microsoft.Workflow.Compiler.exe tests.txt results.txt

AWL bypass

Compile and execute C# or VB.net code in a XOML file referenced in the test.txt file.

Microsoft.Workflow.Compiler.exe tests.txt results.txt