CSC.exe Compiling C# Code with PowerShell Assembly Reference

F S@Fsdr

•updated Jul 8, 2026•12•0•24

Detects the use of the C# compiler (csc.exe) to compile code that references the 'System.Management.Automation' assembly. This pattern is commonly used in 'PS2EXE' techniques or custom loaders to execute PowerShell functionality from within a compiled binary, often to evade security controls that monitor for direct powershell.exe usage.