BIOC Informational

Compiler process started by an Office process

The processes (csc.exe & vbc.exe) invoke compilers via command prompt and compile a payload on the fly. This is leveraged by attackers to create a new payload on every machine.

Module:
Platform Analytics
Agent event type:
Process execution
Category:
Evasion
Status:
Enabled
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Obfuscated Files or Information: Compile After Delivery (T1027.004)
Indicator:

Process action type = execution AND target process name = csc.exe , vbc.exe Process initiated by = excel.exe , powerpnt.exe , winword.exe , outlook.exe , cgo name = excel.exe , powerpnt.exe , winword.exe , outlook.exe

Preventable: yes