Execute C# code located in the consoleapp folder

Detects a suspicious execution of csc.exe, which uses a source in a suspicious folder (e.g. AppData)

Detects a suspicious parent of csc.exe, which could by a sign of payload delivery

When C# is compiled dynamically, a .cmdline file will be created as a part of the process. Certain processes are not typically observed compiling C# code, but can do so without touching disk. This can be used to unpack a payload for execution

Detects successful code compilation via Visual Basic Command Line Compiler that utilizes Windows Resource to Object Converter.