BIOC
Informational
✕
Compiler process started by an Office process
The processes (csc.exe & vbc.exe) invoke compilers via command prompt and compile a payload on the fly. This is leveraged by attackers to create a new payload on every machine.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Evasion
- Status:
- Enabled
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Obfuscated Files or Information: Compile After Delivery (T1027.004)
Indicator:
Process action type = execution AND target process name = csc.exe , vbc.exe Process initiated by = excel.exe , powerpnt.exe , winword.exe , outlook.exe , cgo name = excel.exe , powerpnt.exe , winword.exe , outlook.exe
Preventable: yes