Possible malicious .NET compilation started by a commonly abused process

Analytics BIOC Medium

Possible malicious .NET compilation started by a commonly abused process

Attackers may use csc.exe to compile payloads on a compromised machine.

Module:: Platform Analytics
Data source:: XDR Agent

ATT&CK tactics: Defense Evasion (TA0005)

ATT&CK techniques: Obfuscated Files or Information: Compile After Delivery (T1027.004)

Attacker's goals:

Compile payloads on the host to evade detection.

Investigative actions:

Investigate the payload being compiled. Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.

Test period:: N/A (single event)
Deduplication:: 1 Day