Dynamic .NET Compilation Via Csc.EXE

SigmaHQ Detections@sigmaHQ

•updated Mar 23, 2026•0•0•0

Detects execution of "csc.exe" to compile .NET code. Attackers often leverage this to compile code on the fly and use it in other stages.