Dynamic .NET Compilation via Csc.EXE in Suspicious Locations
This rule detects the execution of 'csc.exe' (C# compiler) in suspicious file system locations. Attackers often use csc.exe to compile .NET code on the fly, enabling them to bypass traditional defenses and execute malicious code during later stages of an attack. The rule specifically looks for csc.exe execution where the command line arguments indicate compilation in temporary directories, user-specific folders like Public, AppData\Local\Temp, or other common user-writable locations that are not typically used for legitimate software compilation.
Sigma
