attack.t1027.004

Csc.EXE Execution Form Potentially Suspicious Parent

Apr 28, 2026 · attack.execution attack.stealth attack.t1059.005 attack.t1059.007 attack.t1218.005 attack.t1027.004 ·

Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.

Dynamic .NET Compilation Via Csc.EXE

Apr 28, 2026 · attack.stealth attack.t1027.004 ·

Detects execution of "csc.exe" to compile .NET code. Attackers often leverage this to compile code on the fly and use it in other stages.

Dynamic CSharp Compile Artefact

Apr 28, 2026 · attack.stealth attack.t1027.004 ·

Share on:

When C# is compiled dynamically, a .cmdline file will be created as a part of the process. Certain processes are not typically observed compiling C# code, but can do so without touching disk. This can be used to unpack a payload for execution

Potential Application Whitelisting Bypass via Dnx.EXE

Apr 28, 2026 · attack.stealth attack.t1218 attack.t1027.004 ·

Share on:

Detects the execution of Dnx.EXE. The Dnx utility allows for the execution of C# code. Attackers might abuse this in order to bypass application whitelisting.

Visual Basic Command Line Compiler Usage

Apr 28, 2026 · attack.stealth attack.t1027.004 ·

Share on:

Detects successful code compilation via Visual Basic Command Line Compiler that utilizes Windows Resource to Object Converter.