Windows Dynamic C# Compilation Generates .cmdline Artifact

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1027.004Compile After Delivery
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags file creation events where a .cmdline file is written, indicating dynamic compilation of C# using a compiler workflow that produces this artifact. Such behavior can be used to generate or unpack content for later execution while reducing or avoiding normal on-disk compilation patterns. The detection relies on Windows file event telemetry capturing the created file’s name matching the .cmdline extension.

Reporting behind it

Related detections5 linkedT1027.004 — drag to rearrange

Windows Process Creation: csc.exe Used for Dynamic .NET Compilation

Windows Visual Basic vbc.exe Compiles to .obj via cvtres.exe Resource Converter

Windows: Process Creation of Dnx.EXE May Indicate Application Whitelisting Bypass

Windows: Alert on csc.exe Executing from User-Writable or Suspicious Paths

Windows: Alert on suspicious parent process spawning csc.exe

Windows Dynamic C# Compilation Generates .cmdline Artifact

Pivot detection · T1027.004 · 5 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-dynamic-c-compilation-creates-cmdline-artefact-e4a74e34

title: Windows Dynamic C# Compilation Generates .cmdline Artifact
id: 7568438b-44d4-4a17-a30a-18b9154b95a5
status: test
description: This rule flags file creation events where a .cmdline file is written, indicating dynamic compilation of C# using a compiler workflow that produces this artifact. Such behavior can be used to generate or unpack content for later execution while reducing or avoiding normal on-disk compilation patterns. The detection relies on Windows file event telemetry capturing the created file’s name matching the .cmdline extension.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027.004/T1027.004.md#atomic-test-2---dynamic-c-compile
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_csharp_compile_artefact.yml
author: frack113, Huntrule Team
date: 2022-01-09
modified: 2023-02-17
tags:
  - attack.stealth
  - attack.t1027.004
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|endswith: .cmdline
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: e4a74e34-ecde-4aab-b2fb-9112dd01aed0
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL