PowerShell process injection into csc.exe (StealC)

Ibrahim Saud@tektrix

•updated Sep 18, 2026•1•0•7

Detects the execution of the C# compiler (csc.exe) initiated by PowerShell. This behavior is often indicative of in-memory compilation and execution of malicious code, bypassing traditional file-based detection.