Command Line
csc.exe -out:My.exe File.cs
Description
Abuse of CSC to compile C# code stored in File.cs and output the compiled application to My.exe.
Risk
High
Risk Reason
Cyber Threats often abuse on-the-fly compilation of code to bypass security measures - but this is also often used by developers and can't always be assumed as suspicious activity.
Fidelity
Medium
Fidelity Reason
Depending on the size of the development organization, this may or may not be difficult to alert on with a high fidelity.
Operating Systems
Killchain Phases
References
MITRE ATT&CK TECHNIQUES
URL: https://attack.mitre.org/techniques/T1127
Description: Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads. There are many utilities used for software development related tasks that can be used to execute code in various forms to assist in development, debugging, and reverse engineering.(Citation: engima0x3 DNX Bypass)(Citation: engima0x3 RCSI Bypass)(Citation: Exploit Monday WinDbg)(Citation: LOLBAS Tracker) These utilities may often be signed with legitimate certificates that allow them to execute on a system and proxy execution of malicious code through a trusted process that effectively bypasses application control solutions.
Tactics: