rule:
meta:
name: compile Visual Basic in .NET
namespace: load-code/dotnet/vb
authors:
- michael.hunhoff@mandiant.com
scopes:
static: function
dynamic: thread
att&ck:
- Defense Evasion::Obfuscated Files or Information::Compile After Delivery [T1027.004]
features:
- and:
- match: compile .NET assembly
- api: Microsoft.VisualBasic.VBCodeProvider::ctor
last edited: 2023-11-24 10:34:28