LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Csc.exe

View source

Binary file used by .NET Framework to compile C# code

Compile
02COMMAND EXAMPLES
01ATT&CK TECHNIQUES
04DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

Compile2

EXAMPLE 01T1127

Use csc.exe to compile C# code, targeting the .NET Framework, stored in the specified .cs file and output the compiled version to the specified .exe path.

COMMAND
csc.exe -out:{PATH:.exe} {PATH:.cs}
USE CASE
Compile attacker code on system. Bypass defensive counter measures.
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
EXAMPLE 02T1127

Use csc.exe to compile C# code, targeting the .NET Framework, stored in the specified .cs file and output the compiled version to a DLL file with the same name.

COMMAND
csc -target:library {PATH:.cs}
USE CASE
Compile attacker code on system. Bypass defensive counter measures.
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
02 / ON DISK

Known paths

C:\Windows\Microsoft.NET\Framework\v4.0.30319\Csc.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Csc.exe
C:\Windows\Microsoft.NET\Framework\v3.5\csc.exe
C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

4 resources

Indicators & detection notes

  • IOC

    Csc.exe should normally not run as System account unless it is used for development.

FURTHER READING

Research & resources