Windows Process Creation: Detecting csc.exe Used to Compile .NET Code

title: "Windows Process Creation: Detecting csc.exe Used to Compile .NET Code"
id: 69ff7134-baf0-4d40-b387-00a55f329b85
status: test
description: This rule flags Windows executions of csc.exe (the .NET C# compiler) where the command line suggests the compiler is being run from user-accessible or temporary locations. Attackers may use on-the-fly compilation to prepare payloads or tooling during other stages of an intrusion. The detection relies on process creation telemetry, using the process image ending in csc.exe and matching suspicious command-line path indicators while excluding several known legitimate parent processes and commands.
references:
  - https://securityboulevard.com/2019/08/agent-tesla-evading-edr-by-removing-api-hooks/
  - https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf
  - https://app.any.run/tasks/c6993447-d1d8-414e-b856-675325e5aa09/
  - https://twitter.com/gN3mes1s/status/1206874118282448897
  - https://github.com/redcanaryco/atomic-red-team/blob/b27a3cb25025161d49ac861cb216db68c46a3537/atomics/T1027.004/T1027.004.md#atomic-test-1---compile-after-delivery-using-cscexe
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_csc_susp_dynamic_compilation.yml
author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems), Huntrule Team
date: 2019-08-24
modified: 2026-03-23
tags:
  - attack.stealth
  - attack.t1027.004
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: \csc.exe
  selection_susp_location_1:
    CommandLine|contains:
      - :\Perflogs\
      - :\Users\Public\
      - \AppData\Local\Temp\
      - \Temporary Internet
      - \Windows\Temp\
  selection_susp_location_2:
    - CommandLine|contains|all:
        - :\Users\
        - \Favorites\
    - CommandLine|contains|all:
        - :\Users\
        - \Favourites\
    - CommandLine|contains|all:
        - :\Users\
        - \Contacts\
    - CommandLine|contains|all:
        - :\Users\
        - \Pictures\
  selection_susp_location_3:
    CommandLine|re: (?:[Pp]rogram[Dd]ata|%(?:[Ll]ocal)?[Aa]pp[Dd]ata%|\\[Aa]pp[Dd]ata\\(?:[Ll]ocal(?:[Ll]ow)?|[Rr]oaming))\\[^\\]{1,256}$
  filter_main_programfiles:
    ParentImage|startswith:
      - C:\Program Files (x86)\
      - C:\Program Files\
  filter_main_sdiagnhost:
    ParentImage: C:\Windows\System32\sdiagnhost.exe
  filter_main_w3p:
    ParentImage: C:\Windows\System32\inetsrv\w3wp.exe
  filter_optional_chocolatey:
    ParentImage:
      - C:\ProgramData\chocolatey\choco.exe
      - C:\ProgramData\chocolatey\tools\shimgen.exe
  filter_optional_defender:
    ParentCommandLine|contains: \ProgramData\Microsoft\Windows Defender Advanced Threat Protection
  filter_optional_ansible:
    ParentCommandLine|contains:
      - JwB7ACIAZgBhAGkAbABlAGQAIgA6AHQAcgB1AGUALAAiAG0AcwBnACIAOgAiAEEAbgBzAGkAYgBsAGUAIAByAGUAcQB1AGkAcgBlAHMAIABQAG8AdwBlAHIAUwBoAGUAbABsACAAdgAzAC4AMAAgAG8AcgAgAG4AZQB3AGUAcgAiAH0AJw
      - cAewAiAGYAYQBpAGwAZQBkACIAOgB0AHIAdQBlACwAIgBtAHMAZwAiADoAIgBBAG4AcwBpAGIAbABlACAAcgBlAHEAdQBpAHIAZQBzACAAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAMwAuADAAIABvAHIAIABuAGUAdwBlAHIAIgB9ACcA
      - nAHsAIgBmAGEAaQBsAGUAZAAiADoAdAByAHUAZQAsACIAbQBzAGcAIgA6ACIAQQBuAHMAaQBiAGwAZQAgAHIAZQBxAHUAaQByAGUAcwAgAFAAbwB3AGUAcgBTAGgAZQBsAGwAIAB2ADMALgAwACAAbwByACAAbgBlAHcAZQByACIAfQAnA
  condition: selection_img and 1 of selection_susp_location_* and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Legitimate software from program files - https://twitter.com/gN3mes1s/status/1206874118282448897
  - Legitimate Microsoft software - https://twitter.com/gabriele_pippi/status/1206907900268072962
  - Ansible
level: medium
license: DRL-1.1
related:
  - id: dcaa3f04-70c3-427a-80b4-b870d73c94c4
    type: derived