title: Dynamic C Sharp Compile Artefact
id: e4a74e34-ecde-4aab-b2fb-9112dd01aed0
status: experimental
description: |
  When C# is compiled dynamically, a .cmdline file will be created as a part of the process.
  Certain processes are not typically observed compiling C# code, but can do so without touching disk.
  This can be used to unpack a payload for execution
author: frack113
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1027.004/T1027.004.md#atomic-test-2---dynamic-c-compile
date: 2022/01/09
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|endswith: '.cmdline'
  condition: selection
falsepositives:
  - Unknown
level: low
tags:
  - attack.defense_evasion
  - attack.t1027.004
