Query: write Sigma for Detects execution of "csc.exe" to compile .NET code. Attackers often leverage this to compile code on the fly and use it
Matching passage: Sigma rule: Detects execution of "csc.exe" to compile .NET code. Attackers often leverage this to compile code on the fly and use it. Logsource: windows / process_creation. Rule: title: Dynamic .NET Compilation Via Csc.EXE id: dcaa3f04-70c3-427a-80b4-b870d73c94c4 status: test description: Detects execution of "csc.exe" to compile .NET code. Attackers often leverage this to compile code on the fly and use it in other stages. references: - https://securityboulevard.com/2019/08/agent-tesla-evading-edr-by-removing-api-hooks/ - https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf - https://app.any.run/tasks/c6993447-d1d8-414e-b856-675325e5aa09/ - https://twitter.com/gN3mes1s/status/1206874118282448897 - https://github.com/redcanaryco/atomic-red-team/blob/b27a3cb25025161d49ac861cb216db68c46a3537/atomics/T1027.004/T1027.004.md#atomic-test-1---compile-after-delivery-using-cscexe author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems) date: 2019-08-24 modified: 2026-03-23 tags: - attack.stealth - attack.t1027.004 logsource: category: process_creation product: windows detection: selection_img: Image|endswith: \csc.exe selection_susp_location_1: CommandLine|contains: - :\Perflogs\ - :\Users\Public\ - \AppData\Local\Temp\ - \Temporary Internet - \Windows\Temp\ selection_susp_location_2: - CommandLine|contains|all: - :\Users\ - \Favorites\ - CommandLine|contains|all: - :\Users\ - \Favourites\ - CommandLine|contains|all: - :\Users\ - \Contacts\ - CommandLine|contains|all: - :\Users\ - \Pictures\ selection_susp_location_3: CommandLine|re: (?:[Pp]rogram[Dd]ata|%(?:[Ll]ocal)?[Aa]pp[Dd]ata%|\\[Aa]pp[Dd]ata\\(?:[Ll]ocal(?:[Ll]ow)?|[Rr]oaming))\\[^\\]{1,256}$ filter_main_programfiles: ParentImage|startswith: - C:\Program Files (x86)\ - C:\Program Files\ filter_main_sdiagnhost: ParentImage: C:\Windows\System32\sdiagnhost.exe filter_main_w3p: ParentImage: C:\Windows\System32\inetsrv\w3wp.exe filter_optional_chocolatey: ParentImage: - C:\ProgramData\chocolatey\choco.exe - C:\ProgramData\chocolatey\tools\shimgen.exe filter_optional_defender: ParentCommandLine|contains: \ProgramData\Microsoft\Windows Defender Advanced Threat Protection filter_optional_ansible: ParentCommandLine|contains: - JwB7ACIAZgBhAGkAbABlAGQAIgA6AHQAcgB1AGUALAAiAG0AcwBnACIAOgAiAEEAbgBzAGkAYgBsAGUAIAByAGUAcQB1AGkAcgBlAHMAIABQAG8AdwBlAHIAUwBoAGUAbABsACAAdgAzAC4AMAAgAG8AcgAgAG4AZQB3AGUAcgAiAH0AJw - cAewAiAGYAYQBpAGwAZQBkACIAOgB0AHIAdQBlACwAIgBtAHMAZwAiADoAIgBBAG4AcwBpAGIAbABlACAAcgBlAHEAdQBpAHIAZQBzACAAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAMwAuADAAIABvAHIAIABuAGUAdwBlAHIAIgB9ACcA - nAHsAIgBmAGEAaQBsAGUAZAAiADoAdAByAHUAZQAsACIAbQBzAGcA
Near-miss passage: Sigma rule: Detects the execution of "wmic" with the "process" flag, which might indicate an attempt to perform reconnaissance on ru. Logsource: windows / process_creation. Rule: title: Potential Process Reconnaissance via Wmic.EXE id: 221b251a-357a-49a9-920a-271802777cc0 status: test description: 'Detects the execution of "wmic" with the "process" flag, which might indicate an attempt to perform reconnaissance on running processes. Adversaries may use wmic to query for running processes and their details as part of their reconnaissance efforts. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic author: frack113 date: 2022-01-01 modified: 2025-12-15 tags: - attack.execution - attack.t1047 - attack.discovery - attack.t1057 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \WMIC.exe - OriginalFileName: wmic.exe selection_cli: CommandLine|contains: process filter_main_creation: CommandLine|contains|all: - call - create filter_main_terminate: CommandLine|contains|all: - call - terminate condition: all of selection* and not 1 of filter_main_* falsepositives: - Unknown level: medium simulation: - type: atomic-red-team name: WMI Reconnaissance Processes technique: T1047 atomic_guid: 5750aa16-0e59-4410-8b9a-8a47ca2788e2 regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_process/info.yml