LOL · Binary

Csc.exe

2 techniques WindowsLOLBAS GPL-3.0

Compile

Compile Windows

Use csc.exe to compile C# code, targeting the .NET Framework, stored in the specified .cs file and output the compiled version to the specified .exe path.

Use Compile attacker code on system. Bypass defensive counter measures.

csc.exe -out:{PATH:.exe} {PATH:.cs}

Context: user
Native: Compile
MITRE: T1127
Detection: Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_csc_susp_parent.yml
Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_csc_susp_folder.yml
Elastic: github.com/elastic/detection-rules/blob/61afb1c1c0c3f50637b1bb194f3e6fb09f476e50/rules/windows/defense_evasion_dotnet_compiler_parent_process.toml
Elastic: github.com/elastic/detection-rules/blob/82ec6ac1eeb62a1383792719a1943b551264ed16/rules/windows/defense_evasion_execution_msbuild_started_unusal_process.toml
IOC: Csc.exe should normally not run as System account unless it is used for development.
Refs: learn.microsoft.com/en-us/dotnet/csharp/language-reference/compiler-options/
lolbas-project.github.io/lolbas/Binaries/Csc/

Compile

Compile Windows

Use csc.exe to compile C# code, targeting the .NET Framework, stored in the specified .cs file and output the compiled version to a DLL file with the same name.

Use Compile attacker code on system. Bypass defensive counter measures.

csc -target:library {PATH:.cs}

Context: user
Native: Compile
MITRE: T1127
Detection: Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_csc_susp_parent.yml
Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_csc_susp_folder.yml
Elastic: github.com/elastic/detection-rules/blob/61afb1c1c0c3f50637b1bb194f3e6fb09f476e50/rules/windows/defense_evasion_dotnet_compiler_parent_process.toml
Elastic: github.com/elastic/detection-rules/blob/82ec6ac1eeb62a1383792719a1943b551264ed16/rules/windows/defense_evasion_execution_msbuild_started_unusal_process.toml
IOC: Csc.exe should normally not run as System account unless it is used for development.
Refs: learn.microsoft.com/en-us/dotnet/csharp/language-reference/compiler-options/
lolbas-project.github.io/lolbas/Binaries/Csc/