BIOC
Low
✕
Suspicious .NET process spawns csc.exe
A suspicious process in the Microsoft .NET directory spawned the C# compiler. This may occur if an attacker masquerades a process like MSBuild (e.g. PowerLessShell).
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Evasion
- Status:
- Enabled
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Masquerading (T1036) Obfuscated Files or Information: Compile After Delivery (T1027.004)
Indicator:
Process action type = execution AND target process name = csc.exe Process initiated by != ieexec.exe AND msbuild.exe AND aspnet_compiler.exe AND servicemodelreg.exe AND webdev.webserver.exe AND installutil.exe AND microsoft.workflow.compiler.exe AND regasm.exe AND initiator path = *windows\microsoft.net* AND cgo name != werfault.exe Host host os = windows
Preventable: yes