Windows: Alert on csc.exe Executing from User-Writable or Suspicious Paths

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1027.004Compile After Delivery
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process executions of csc.exe when command-line arguments indicate the compiler is being run from or interacting with user-writable and commonly abused locations (for example, Temp, Perflogs, or Temporary Internet) or specific user directory targets. Compiling .NET code on the fly can enable stealthy staging and follow-on payload execution, so identifying csc.exe launched with suspicious path context is important. It relies on process creation telemetry including Image ending with csc.exe, command-line contents, and parent process context for multiple exclusions.

Reporting behind it

Related detections5 linkedT1027.004 — drag to rearrange

Windows Process Creation: csc.exe Used for Dynamic .NET Compilation

Windows Dynamic C# Compilation Generates .cmdline Artifact

Windows Visual Basic vbc.exe Compiles to .obj via cvtres.exe Resource Converter

Windows: Process Creation of Dnx.EXE May Indicate Application Whitelisting Bypass

Windows: Alert on suspicious parent process spawning csc.exe

Windows: Alert on csc.exe Executing from User-Writable or Suspicious Paths

Pivot detection · T1027.004 · 5 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-detecting-csc-exe-used-to-compile-net-code-dcaa3f04

title: "Windows: Alert on csc.exe Executing from User-Writable or Suspicious Paths"
id: 69ff7134-baf0-4d40-b387-00a55f329b85
status: test
description: This rule flags process executions of csc.exe when command-line arguments indicate the compiler is being run from or interacting with user-writable and commonly abused locations (for example, Temp, Perflogs, or Temporary Internet) or specific user directory targets. Compiling .NET code on the fly can enable stealthy staging and follow-on payload execution, so identifying csc.exe launched with suspicious path context is important. It relies on process creation telemetry including Image ending with csc.exe, command-line contents, and parent process context for multiple exclusions.
references:
  - https://securityboulevard.com/2019/08/agent-tesla-evading-edr-by-removing-api-hooks/
  - https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf
  - https://app.any.run/tasks/c6993447-d1d8-414e-b856-675325e5aa09/
  - https://twitter.com/gN3mes1s/status/1206874118282448897
  - https://github.com/redcanaryco/atomic-red-team/blob/b27a3cb25025161d49ac861cb216db68c46a3537/atomics/T1027.004/T1027.004.md#atomic-test-1---compile-after-delivery-using-cscexe
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_csc_susp_dynamic_compilation.yml
author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems), Huntrule Team
date: 2019-08-24
modified: 2026-03-23
tags:
  - attack.stealth
  - attack.t1027.004
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: \csc.exe
  selection_susp_location_1:
    CommandLine|contains:
      - :\Perflogs\
      - :\Users\Public\
      - \AppData\Local\Temp\
      - \Temporary Internet
      - \Windows\Temp\
  selection_susp_location_2:
    - CommandLine|contains|all:
        - :\Users\
        - \Favorites\
    - CommandLine|contains|all:
        - :\Users\
        - \Favourites\
    - CommandLine|contains|all:
        - :\Users\
        - \Contacts\
    - CommandLine|contains|all:
        - :\Users\
        - \Pictures\
  selection_susp_location_3:
    CommandLine|re: (?:[Pp]rogram[Dd]ata|%(?:[Ll]ocal)?[Aa]pp[Dd]ata%|\\[Aa]pp[Dd]ata\\(?:[Ll]ocal(?:[Ll]ow)?|[Rr]oaming))\\[^\\]{1,256}$
  filter_main_programfiles:
    ParentImage|startswith:
      - C:\Program Files (x86)\
      - C:\Program Files\
  filter_main_sdiagnhost:
    ParentImage: C:\Windows\System32\sdiagnhost.exe
  filter_main_w3p:
    ParentImage: C:\Windows\System32\inetsrv\w3wp.exe
  filter_optional_chocolatey:
    ParentImage:
      - C:\ProgramData\chocolatey\choco.exe
      - C:\ProgramData\chocolatey\tools\shimgen.exe
  filter_optional_defender:
    ParentCommandLine|contains: \ProgramData\Microsoft\Windows Defender Advanced Threat Protection
  filter_optional_ansible:
    ParentCommandLine|contains:
      - JwB7ACIAZgBhAGkAbABlAGQAIgA6AHQAcgB1AGUALAAiAG0AcwBnACIAOgAiAEEAbgBzAGkAYgBsAGUAIAByAGUAcQB1AGkAcgBlAHMAIABQAG8AdwBlAHIAUwBoAGUAbABsACAAdgAzAC4AMAAgAG8AcgAgAG4AZQB3AGUAcgAiAH0AJw
      - cAewAiAGYAYQBpAGwAZQBkACIAOgB0AHIAdQBlACwAIgBtAHMAZwAiADoAIgBBAG4AcwBpAGIAbABlACAAcgBlAHEAdQBpAHIAZQBzACAAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAMwAuADAAIABvAHIAIABuAGUAdwBlAHIAIgB9ACcA
      - nAHsAIgBmAGEAaQBsAGUAZAAiADoAdAByAHUAZQAsACIAbQBzAGcAIgA6ACIAQQBuAHMAaQBiAGwAZQAgAHIAZQBxAHUAaQByAGUAcwAgAFAAbwB3AGUAcgBTAGgAZQBsAGwAIAB2ADMALgAwACAAbwByACAAbgBlAHcAZQByACIAfQAnA
  condition: selection_img and 1 of selection_susp_location_* and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Legitimate software from program files - https://twitter.com/gN3mes1s/status/1206874118282448897
  - Legitimate Microsoft software - https://twitter.com/gabriele_pippi/status/1206907900268072962
  - Ansible
level: medium
license: DRL-1.1
related:
  - id: dcaa3f04-70c3-427a-80b4-b870d73c94c4
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL