Suspicious CSharp Compilation via CSC from Temp
Detects csc.exe compiling code from Temp or AppData locations, a common pattern for dropper and loader build steps on compromised hosts.
Sigma
Detects csc.exe compiling code from Temp or AppData locations, a common pattern for dropper and loader build steps on compromised hosts.
Already have an account?