Execute C# code located in the consoleapp folder
Detects a suspicious execution of csc.exe, which uses a source in a suspicious folder (e.g. AppData)
Detects a suspicious parent of csc.exe, which could by a sign of payload delivery
When C# is compiled dynamically, a .cmdline file will be created as a part of the process.
Certain processes are not typically observed compiling C# code, but can do so without touching disk.
This can be used to unpack a payload for execution
Detects successful code compilation via Visual Basic Command Line Compiler that utilizes Windows Resource to Object Converter.