huntrule

Windows Dynamic C# Compilation Generates .cmdline Artifact

Detects Windows file events where dynamic C# compilation produces a .cmdline artefact.

FreeReviewedSigma · Low · v2
Product
windows
Category
file_event
Author
frack113 (SigmaHQ), DRL 1.1
Published
2022-01-09
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags file creation events where a .cmdline file is written, indicating dynamic compilation of C# using a compiler workflow that produces this artifact. Such behavior can be used to generate or unpack content for later execution while reducing or avoiding normal on-disk compilation patterns. The detection relies on Windows file event telemetry capturing the created file’s name matching the .cmdline extension.

Reporting behind it

Related detections5 linkedT1027.004 — drag to rearrange
Windows Process Creation: csc.exe Used for Dynamic .NET Compilation
Windows Visual Basic vbc.exe Compiles to .obj via cvtres.exe Resource Converter
Windows: Process Creation of Dnx.EXE May Indicate Application Whitelisting Bypass
Windows: Alert on csc.exe Executing from User-Writable or Suspicious Paths
Windows: Alert on suspicious parent process spawning csc.exe
Windows Dynamic C# Compilation Generates .cmdline Artifact
Pivot detection · T1027.004 · 5 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.