Csc.exe

Use csc.exe to compile C# code, targeting the .NET Framework, stored in the specified .cs file and output the compiled version to the specified .exe path.

Use Compile attacker code on system. Bypass defensive counter measures.

csc.exe -out:{PATH:.exe} {PATH:.cs}

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Compile

MITRE

T1127

Detection

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_csc_susp_parent.yml

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_csc_susp_folder.yml

Elastic: github.com/elastic/detection-rules/blob/61afb1c1c0c3f50637b1bb194f3e6fb09f476e50/rules/windows/defense_evasion_dotnet_compiler_parent_process.toml

Elastic: github.com/elastic/detection-rules/blob/82ec6ac1eeb62a1383792719a1943b551264ed16/rules/windows/defense_evasion_execution_msbuild_started_unusal_process.toml

IOC: Csc.exe should normally not run as System account unless it is used for development.

Refs

learn.microsoft.com/en-us/dotnet/csharp/language-reference/compiler-options/

lolbas-project.github.io/lolbas/Binaries/Csc/

Use csc.exe to compile C# code, targeting the .NET Framework, stored in the specified .cs file and output the compiled version to a DLL file with the same name.

Use Compile attacker code on system. Bypass defensive counter measures.

csc -target:library {PATH:.cs}

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Compile

MITRE

T1127

Detection

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_csc_susp_parent.yml

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_csc_susp_folder.yml

Elastic: github.com/elastic/detection-rules/blob/61afb1c1c0c3f50637b1bb194f3e6fb09f476e50/rules/windows/defense_evasion_dotnet_compiler_parent_process.toml

Elastic: github.com/elastic/detection-rules/blob/82ec6ac1eeb62a1383792719a1943b551264ed16/rules/windows/defense_evasion_execution_msbuild_started_unusal_process.toml

IOC: Csc.exe should normally not run as System account unless it is used for development.

Refs

learn.microsoft.com/en-us/dotnet/csharp/language-reference/compiler-options/

lolbas-project.github.io/lolbas/Binaries/Csc/