Dynamic .NET Compilation Via Csc.EXE - Hunting

Detects execution of "csc.exe" to compile .NET code. Attackers often leverage this to compile code on the fly and use it in other stages.

Sigma