Dynamic C# Compile Artifact Detection
This rule detects the creation of '.cmdline' files, which are artifacts generated during dynamic C# compilation. Adversaries may use dynamic C# compilation to unpack and execute payloads without writing the compiled executable to disk, making it a defense evasion technique. The rule specifically looks for the creation of these files as an indicator of such activity, particularly when initiated by processes not typically associated with C# compilation.
Sigma
