ngen.exe

ngen.exe compiles managed assemblies into native images and maintains those images, work normally driven by .NET setup and by the ".NET Framework NGEN" scheduled tasks that run during idle time. It ships with the .NET Framework, so the genuine binary lives under C:\Windows\Microsoft.NET\Framework and Framework64, not System32.

Legitimately, ngen runs automatically after .NET updates and during maintenance windows, parented by the Task Scheduler. Interactive or oddly-parented invocations are what give an instance meaning.

ngen.exe is a system-binary proxy and a persistence aid (T1218). Because it compiles and can trigger execution of .NET assemblies, it has been used to run attacker code under a trusted Microsoft binary, bypassing application-control rules that allow .NET tooling. The built-in NGEN scheduled tasks are also a persistence surface: pointing them at attacker code gives a SYSTEM-context execution that runs during normal maintenance.

Because ngen legitimately runs only as part of .NET servicing, an ngen invoked interactively, by an Office or script-host parent, or against an assembly in a user-writable path is what separates abuse from routine native-image generation.