Csc.EXE Execution From Potentially Suspicious Parent

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•21

Detects potentially suspicious execution of 'csc.exe' (C# compiler) when spawned by common applications like Office programs, scripting engines (cscript.exe, wscript.exe, mshta.exe, powershell.exe), or from suspicious file system locations. This behavior can indicate payload delivery, compilation of malicious code on the fly, or defense evasion techniques.