Dynamic CSharp Compile Artefact

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•2

When C# is compiled dynamically, a .cmdline file will be created as a part of the process. Certain processes are not typically observed compiling C# code, but can do so without touching disk. This can be used to unpack a payload for execution