Windows Dynamic C# Compilation Creates .cmdline Artefact

Detects Windows file events where dynamic C# compilation produces a .cmdline artefact.

FreeUnreviewedSigmalowv1

windows-dynamic-c-compilation-creates-cmdline-artefact-e4a74e34

title: Windows Dynamic C# Compilation Creates .cmdline Artefact
id: 7568438b-44d4-4a17-a30a-18b9154b95a5
status: test
description: This rule flags the creation of files with a .cmdline extension on Windows, which can occur during dynamic C# compilation. Attackers may use dynamic compilation to unpack or stage payloads without using traditional compilation workflows or expected disk artifacts. The detection relies on file creation or file event telemetry that includes the created filename and its extension.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027.004/T1027.004.md#atomic-test-2---dynamic-c-compile
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_csharp_compile_artefact.yml
author: frack113, Huntrule Team
date: 2022-01-09
modified: 2023-02-17
tags:
  - attack.stealth
  - attack.t1027.004
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|endswith: .cmdline
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: e4a74e34-ecde-4aab-b2fb-9112dd01aed0
    type: derived

What it detects

This rule flags the creation of files with a .cmdline extension on Windows, which can occur during dynamic C# compilation. Attackers may use dynamic compilation to unpack or stage payloads without using traditional compilation workflows or expected disk artifacts. The detection relies on file creation or file event telemetry that includes the created filename and its extension.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.