Possible Dynamic CSharp Compile Artefact (via file_event)

title: Possible Dynamic CSharp Compile Artefact (via file_event)
id: fa4a6603-3f92-5c68-8439-b5ef7ebde636
status: stable
description: This rule detects when C# is compiled dynamically, a .cmdline file will be created as a part of the process. Certain processes are not usually observed compiling C# code, but can do so without touching disk. This can be leveraged to unpack a payload for execution
references:
    - https://attack.mitre.org/techniques/T1027/004/
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027.004/T1027.004.md#atomic-test-2---dynamic-c-compile
author: Huntrule Team
date: 2026-03-23
tags:
    - attack.stealth
    - attack.t1027.004
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename|endswith: '.cmdline'
    condition: selection
falsepositives:
    - Unknown
level: low