rule:
meta:
name: compile CSharp in .NET
namespace: load-code/dotnet/csharp
authors:
- michael.hunhoff@mandiant.com
scopes:
static: function
dynamic: thread
att&ck:
- Defense Evasion::Obfuscated Files or Information::Compile After Delivery [T1027.004]
features:
- and:
- match: compile .NET assembly
- api: Microsoft.CSharp.CSharpCodeProvider::ctor
last edited: 2023-11-24 10:34:28