{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/evading-security-controls/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["stealth","evading-security-controls","windows","dot-net"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe C# compiler (csc.exe) is a legitimate component of the .NET framework used for building source code into assemblies. Threat actors, including groups observed in MuddyWater operations and campaigns utilizing Agent Tesla, abuse this utility to perform dynamic, on-the-fly compilation of malicious payloads. By compiling code directly on the target host, attackers avoid writing static malicious binaries to disk, thereby bypassing traditional file-based signature detection. This technique is often employed in the post-exploitation phase to execute custom loaders, stagers, or modules that interact with system APIs to disable security instrumentation or perform further reconnaissance. Defenders should monitor for csc.exe process creation events occurring within non-standard execution paths, such as temporary user directories or user-profile subfolders, which are common staging areas for this activity.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInitial access is established via phishing or exploit, placing a source code file (typically .cs) on the host.\u003c/li\u003e\n\u003cli\u003eAttacker writes the malicious source code to a temp location, such as C:\\Users\\Public\\ or %TEMP%.\u003c/li\u003e\n\u003cli\u003eAttacker invokes csc.exe from the command line to compile the written source code.\u003c/li\u003e\n\u003cli\u003eThe compiler (csc.exe) reads the source file and generates an assembly in memory or as a temporary executable.\u003c/li\u003e\n\u003cli\u003eThe resulting assembly is executed, either directly through process injection or via a follow-on execution command.\u003c/li\u003e\n\u003cli\u003eThe malicious assembly executes, performing tasks like API hooking removal or C2 beaconing.\u003c/li\u003e\n\u003cli\u003eThe primary objective, such as credential theft or sensitive data exfiltration, is achieved using the memory-resident code.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful abuse of dynamic compilation allows attackers to execute arbitrary code while significantly reducing their disk footprint. This technique has been observed in global operations targeting varied sectors, allowing actors to maintain persistence and evade endpoint security controls. Failure to detect this activity can lead to long-term undetected presence within a network, resulting in unauthorized data access and potential system compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eDeploy the provided Sigma rule to detect suspicious csc.exe execution patterns.\u003c/li\u003e\n\u003cli\u003eBaseline legitimate csc.exe usage in the environment, specifically identifying build pipelines or automated tools that invoke the compiler from standard directories (e.g., C:\\Program Files).\u003c/li\u003e\n\u003cli\u003eImplement process creation logging via Sysmon (Event ID 1) to capture command line arguments and parent process relationships for csc.exe.\u003c/li\u003e\n\u003cli\u003eHunt for anomalous process execution paths for csc.exe (e.g., AppData, Temp, Perflogs) and correlate these events with unexpected network activity or unauthorized API calls.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-01T12:19:51Z","date_published":"2026-09-01T12:19:51Z","id":"https://feed.craftedsignal.io/briefs/2026-09-dynamic-dotnet-compilation/","summary":"Attackers utilize the C# compiler (csc.exe) to dynamically compile and execute malicious code in memory, enabling evasion of signature-based defenses and EDR hooks.","title":"Suspicious Dynamic .NET Compilation via Csc.exe","url":"https://feed.craftedsignal.io/briefs/2026-09-dynamic-dotnet-compilation/"}],"language":"en","title":"CraftedSignal Threat Feed - Evading-Security-Controls","version":"https://jsonfeed.org/version/1.1"}