Suspicious Csc.exe Execution via Unconventional Parent Processes

The C# compiler (csc.exe) is a legitimate Windows binary often abused by threat actors to perform just-in-time compilation of payloads. By invoking csc.exe via script engines (WScript, CScript, PowerShell) or office application macros, attackers can transform obfuscated source code or embedded strings into executable binaries directly in memory or within temporary directories. This technique, commonly referred to as "living off the land" (LotL), allows for effective evasion of static file-based signature detection, as the malicious executable is generated on the target endpoint at runtime. Defenders should focus on identifying atypical parent-child process relationships involving csc.exe, particularly when the parent is an application not typically associated with development or build tasks.

Attack Chain

1. Initial delivery via spearphishing attachment (e.g., weaponized Office document or script).
2. Execution of malicious macros or script code embedded in the delivery file.
3. The parent process (e.g., winword.exe, outlook.exe, powershell.exe) creates a child process: csc.exe.
4. The parent process provides command-line arguments to csc.exe containing the source code path or parameters for compilation.
5. csc.exe compiles the provided source code into a temporary or hidden executable file.
6. The newly compiled binary is executed to establish persistence or inject malicious code into other processes (e.g., process hollowing).
7. Final objective achieved (e.g., deployment of RAT, infostealer, or ransomware).

Impact

Successful exploitation allows threat actors to bypass static security controls and execute arbitrary code in memory. This technique has been observed in various malware campaigns, including WarzoneRAT and Yellow Liderc, resulting in data exfiltration, persistent unauthorized access, and potential ransomware deployment.

Recommendation

• Deploy the provided Sigma rule to monitor for suspicious process-creation events where csc.exe is spawned by unconventional parents.
• Establish a baseline for legitimate csc.exe execution patterns in the environment, specifically for DevOps or build servers, and filter these from the detection.
• Enable Sysmon or Windows Event Log (Event ID 4688) with command-line auditing to capture the full invocation of csc.exe for incident investigation.
• Investigate any occurrences of csc.exe spawning from paths such as \Temp, \Public, or \AppData\ directories, as these are highly indicative of malicious activity.