T1027.004: Obfuscated PowerShell with csc.exe C# Compilation - Chrome NativeMsg Backdoor

Tim Peck@timpeck

•updated Jul 1, 2026•13•2•43

Detects obfuscated PowerShell execution (utilizing common bypass and hiding flags) that subsequently spawns the C# compiler (csc.exe) from suspicious locations (AppData, Temp, or tmp directories). This pattern is consistent with fileless payload delivery and runtime compilation, such as that observed in recent NeptuneRAT campaigns leveraging Chrome Native Messaging.