Hide Navigation Hide TOC

Dynamic .NET Compilation Via Csc.EXE (dcaa3f04-70c3-427a-80b4-b870d73c94c4)

Detects execution of "csc.exe" to compile .NET code. Attackers often leverage this to compile code on the fly and use it in other stages.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Dynamic .NET Compilation Via Csc.EXE (dcaa3f04-70c3-427a-80b4-b870d73c94c4)	Sigma-Rules	Compile After Delivery - T1027.004 (c726e0a2-a57a-4b7b-a973-d0f013246617)	Attack Pattern	1
Obfuscated Files or Information - T1027 (b3d682b6-98f2-4fb0-aa3b-b4df007ca70a)	Attack Pattern	Compile After Delivery - T1027.004 (c726e0a2-a57a-4b7b-a973-d0f013246617)	Attack Pattern	2