PowerShell Executing CSharp Interactive Console (csi.exe) on Windows

Alerts when PowerShell launches csi.exe, indicating possible interactive .NET code execution.

FreeUnreviewedSigmahighv1

powershell-executing-csharp-interactive-console-csi-exe-on-windows-a9e416a8

title: PowerShell Executing CSharp Interactive Console (csi.exe) on Windows
id: 9d284fe3-61e4-4fb1-ba86-916d8e369815
status: test
description: This rule flags Windows process creation where PowerShell spawns csi.exe (C# interactive console). Attackers may use interactive .NET tooling to run code in memory and quickly test or execute payloads while blending into legitimate developer utilities. It relies on process creation telemetry, specifically matching the image name csi.exe and verifying the parent process is powershell.exe, pwsh.exe, or powershell_ise.exe.
references:
  - https://redcanary.com/blog/detecting-attacks-leveraging-the-net-framework/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_csi_use_of_csharp_console.yml
author: Michael R. (@nahamike01), Huntrule Team
date: 2020-03-08
modified: 2022-07-14
tags:
  - attack.execution
  - attack.stealth
  - attack.t1127
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \csi.exe
    ParentImage|endswith:
      - \powershell.exe
      - \pwsh.exe
      - \powershell_ise.exe
    OriginalFileName: csi.exe
  condition: selection
falsepositives:
  - Possible depending on environment. Pair with other factors such as net connections, command-line args, etc.
level: high
license: DRL-1.1
related:
  - id: a9e416a8-e613-4f8b-88b8-a7d1d1af2f61
    type: derived

What it detects

This rule flags Windows process creation where PowerShell spawns csi.exe (C# interactive console). Attackers may use interactive .NET tooling to run code in memory and quickly test or execute payloads while blending into legitimate developer utilities. It relies on process creation telemetry, specifically matching the image name csi.exe and verifying the parent process is powershell.exe, pwsh.exe, or powershell_ise.exe.

Known false positives

Possible depending on environment. Pair with other factors such as net connections, command-line args, etc.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.