Identifier / Programs / Windows

csc.exe

The Microsoft C# Compiler. tldr-pages

LOLBAS Compile 9 Sigma rules name it 6 ATT&CK techniques 2 documented commands 4 known copies with hashes

How csc.exe is abused

documented by LOLBAS

Compile T1127 Trusted Developer Utilities Proxy Execution

-out

Compile T1127 Trusted Developer Utilities Proxy Execution

-target

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for csc.exe.

2 documented commands

from LOLBAS, each read by the identifier

Compile T1127 Trusted Developer Utilities Proxy Execution User privileges

Use csc.exe to compile C# code, targeting the .NET Framework, stored in the specified .cs file and output the compiled version to the specified .exe path.

csc.exe -out:{PATH:.exe} {PATH:.cs}

Identify

Compile T1127 Trusted Developer Utilities Proxy Execution User privileges

Use csc.exe to compile C# code, targeting the .NET Framework, stored in the specified .cs file and output the compiled version to a DLL file with the same name.

csc -target:library {PATH:.cs}

Identify

None of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for csc.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for csc.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

highCsc.EXE Execution Form Potentially Suspicious ParentFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)

mediumPotential MOVEit Transfer CVE-2023-34362 Exploitation - Dynamic Compilation Via Csc.EXE@kostastsale

mediumDynamic .NET Compilation Via Csc.EXE - HuntingNasreddine Bencherchali (Nextron Systems)

mediumDynamic .NET Compilation Via Csc.EXEFlorian Roth (Nextron Systems), X__Junior (Nextron Systems)

criticalExploit for CVE-2017-8759Florian Roth (Nextron Systems)

highPaperCut MF/NG Potential ExploitationNasreddine Bencherchali (Nextron Systems), Huntress DE&TH Team (idea)

highRemote Access Tool - ScreenConnect Server Web Shell ExecutionJason Rathbun (Blackpoint Cyber)

mediumPotentially Suspicious Execution Of PDQDeployRunnerNasreddine Bencherchali (Nextron Systems)

mediumSuspicious WindowsTerminal Child ProcessesNasreddine Bencherchali (Nextron Systems)

T1027.004Obfuscated Files or Information: Compile After Delivery

T1059Command and Scripting Interpreter

T1059.005Command and Scripting Interpreter: Visual Basic

T1059.007Command and Scripting Interpreter: JavaScript

T1127Trusted Developer Utilities Proxy Execution

T1218.005System Binary Proxy Execution: Mshta

Is it the real csc.exe?

file version info and known copies

Installed inC:\Windows\Microsoft.NET\Framework64\v4.0.30319\
C:\Windows\Microsoft.NET\Framework\v4.0.30319\

Signed byMicrosoft Windows

ProductMicrosoft .NET Framework, Microsoft Corporation

DescriptionVisual C# Command Line Compiler

4 known copies

4.8.4161.0 built by: NET48REL1 · C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\csc.exe · signed by Microsoft Windows

4458132afc157ed1943f0fee08fb8dce30b46eca73ac07c45026378b47d8be64

4.8.4161.0 built by: NET48REL1 · C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\csc.exe · signed by Microsoft Windows

adeda78a951529462f9411e016c1a1b87ddfd94c55912cbd2957817f39929af1

4.8.4084.0 built by: NET48REL1 · C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe · signed by Microsoft Windows

38c407dbf41e99396b78d00dd796930d8838dcb4af77c3f23ba0e800d1213ebe

4.8.4084.0 built by: NET48REL1 · C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe · signed by Microsoft Windows

4a6d0864e19c0368a47217c129b075dddf61a6a262388f9d21045d82f3423ed7

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

Everyday use

from tldr-pages, CC BY 4.0

Compile one or more C# files to a CIL executable

csc path/to/input_file1.cs path/to/input_file2.cs ...Identify

Specify the output filename

csc /out:path/to/file path/to/input_file.csIdentify

Matches LOLBAS abuse: Compile (T1127)

Compile into a .dll library instead of an executable

csc /target:library path/to/input_file.csIdentify