SilentCanvas - Dynamic C# Compilation via LOLBin

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•1

Detects PowerShell spawning csc.exe to dynamically compile and drop the uds.exe payload on the endpoint. This rule specifically looks for the creation of 'uds.exe' by a process that was initiated by 'csc.exe', which itself was spawned by 'powershell.exe'.