Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
54 detections
Filters
Last updated
All Time
Detection languages
29
17
4
2
1
Contributors
13
11
10
5
4
Categories
44
14
10
7
5
Platforms
49
6
2
1
Products / Services
15
12
9
3
3
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
2
IDS Protocols
2
Detects execution of "csc.exe" to compile .NET code. Attackers often leverage this to compile code on the fly and use it in other stages.
Detects the execution of Dnx.EXE. The Dnx utility allows for the execution of C# code.
Attackers might abuse this in order to bypass application whitelisting.
Attackers might abuse this in order to bypass application whitelisting.
When C# is compiled dynamically, a .cmdline file will be created as a part of the process.
Certain processes are not typically observed compiling C# code, but can do so without touching disk.
This can be used to unpack a payload for execution
Certain processes are not typically observed compiling C# code, but can do so without touching disk.
This can be used to unpack a payload for execution
The following analytic detects the use of the .NET compiler csc.exe for on-the-fly compilation of potentially malicious .NET code. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific command-line patterns associated with csc.exe. This activity is significant because adversaries and malware often use this technique to evade detection by compiling malicious code at runtime. If confirmed malicious, this could allow attackers to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further lateral movement within the network.
Detects the execution of "csc.exe" to compile .NET code with specific command-line arguments. Attackers often leverage this to compile code on the fly and use it in other stages, potentially for defense evasion or to deliver malicious payloads.
Detects potentially suspicious execution of 'csc.exe' (C# compiler) when spawned by common applications like Office programs, scripting engines (cscript.exe, wscript.exe, mshta.exe, powershell.exe), or from suspicious file system locations. This behavior can indicate payload delivery, compilation of malicious code on the fly, or defense evasion techniques.
This rule detects the creation of '.cmdline' files, which are artifacts generated during dynamic C# compilation. Adversaries may use dynamic C# compilation to unpack and execute payloads without writing the compiled executable to disk, making it a defense evasion technique. The rule specifically looks for the creation of these files as an indicator of such activity, particularly when initiated by processes not typically associated with C# compilation.
This rule detects the execution of 'csc.exe' (C# compiler) in suspicious file system locations. Attackers often use csc.exe to compile .NET code on the fly, enabling them to bypass traditional defenses and execute malicious code during later stages of an attack. The rule specifically looks for csc.exe execution where the command line arguments indicate compilation in temporary directories, user-specific folders like Public, AppData\Local\Temp, or other common user-writable locations that are not typically used for legitimate software compilation.
Detects the execution of the Visual Basic Command Line Compiler (vbc.exe) where it acts as a parent process to the Windows Resource to Object Converter (cvtres.exe). This combination indicates successful code compilation, which can be abused by adversaries to compile malicious code on a compromised system.
Detects the use of the 'Ilasm.exe' utility to compile C# Intermediate Language (IL) code into executable (EXE) or dynamic-link library (DLL) files. This activity can be indicative of an adversary compiling malicious code on a compromised system, potentially to bypass security controls or execute custom payloads.
Detects the execution of Dnx.EXE, which can be abused by attackers to bypass application whitelisting by executing C# code.
Detects suspicious PowerShell code that is UTF16 and base64 encoded, often used in command lines for obfuscation. The rule specifically looks for patterns indicative of obfuscated PowerShell, such as '-bxor 0x', '.Invoke() |', and format string patterns like '{1}{0}" -f' or '{0}{3}" -f' in their encoded forms.
Page 3 of 3