Detectionlowtest
Dynamic CSharp Compile Artefact
When C# is compiled dynamically, a .cmdline file will be created as a part of the process. Certain processes are not typically observed compiling C# code, but can do so without touching disk. This can be used to unpack a payload for execution
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Log Source
WindowsFile Event
ProductWindows← raw: windows
CategoryFile Event← raw: file_event
Events for file system activity including creation, modification, and deletion.
Detection Logic
Detection Logic1 selector
detection:
selection:
TargetFilename|endswith: '.cmdline'
condition: selectionFalse Positives
Unknown
False positive likelihood has not been assessed. Additional context may be needed during triage.
References
MITRE ATT&CK
Tactics
Sub-techniques
Rule Metadata
Rule ID
e4a74e34-ecde-4aab-b2fb-9112dd01aed0
Status
test
Level
low
Type
Detection
Created
Sun Jan 09
Modified
Fri Feb 17
Author
Path
rules/windows/file/file_event/file_event_win_csharp_compile_artefact.yml
Raw Tags
attack.defense-evasionattack.t1027.004