PowerShell Spawns csc.exe to Compile In-Memory .NET Payload

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•2

Detects instances where PowerShell.exe spawns the .NET C# compiler (csc.exe) with command-line arguments referencing a '.cmdline' file. This pattern is commonly used by adversaries to compile malicious code in-memory, bypassing traditional disk-based file scanning.