Suspicious Csi.exe or Rcsi.exe Usage
This rule detects the execution of 'csi.exe' or 'rcsi.exe', which are signed Microsoft binaries associated with Visual Studio. These executables provide C# interactive capabilities and can be abused by adversaries to run arbitrary C# code from a file, potentially bypassing application whitelisting and enabling execution or defense evasion. The rule specifically looks for the process image ending with '\csi.exe' or '\rcsi.exe' or the original filename being 'csi.exe' or 'rcsi.exe', combined with the company name 'Microsoft Corporation'.
Sigma
