Runtime C# compilation via csc.exe against temporary .cmdline files
Detects the execution of csc.exe (the C# command-line compiler) with specific command-line arguments (/noconfig, /fullpaths) and a response file (.cmdline) located within a temporary directory. This pattern is commonly associated with fileless malware, such as Banana RAT, which compiles its components at runtime to bypass static file-based detection.
Microsoft Sentinel (KQL)
