Dynamic .NET Compilation via Csc.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•33

Detects the execution of "csc.exe" to compile .NET code with specific command-line arguments. Attackers often leverage this to compile code on the fly and use it in other stages, potentially for defense evasion or to deliver malicious payloads.