Detection rules › Sigma
Suspicious Use of CSharp Interactive Console
Detects the execution of CSharp interactive console by PowerShell
Known false positives
- Possible depending on environment. Pair with other factors such as net connections, command-line args, etc.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | |
| Stealth |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
Rule body
title: Suspicious Use of CSharp Interactive Console
id: a9e416a8-e613-4f8b-88b8-a7d1d1af2f61
status: test
description: Detects the execution of CSharp interactive console by PowerShell
references:
- https://redcanary.com/blog/detecting-attacks-leveraging-the-net-framework/
author: Michael R. (@nahamike01)
date: 2020-03-08
modified: 2022-07-14
tags:
- attack.execution
- attack.stealth
- attack.t1127
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: '\csi.exe'
ParentImage|endswith:
- '\powershell.exe'
- '\pwsh.exe'
- '\powershell_ise.exe'
OriginalFileName: 'csi.exe'
condition: selection
falsepositives:
- Possible depending on environment. Pair with other factors such as net connections, command-line args, etc.
level: high
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
Image|endswith: '\csi.exe'
ParentImage|endswith:
- '\powershell.exe'
- '\pwsh.exe'
- '\powershell_ise.exe'
OriginalFileName: 'csi.exe'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
Image | ends_with |
| field:"Image" kind:ends_with value:"\csi.exe" |
OriginalFileName | eq |
| field:"OriginalFileName" kind:eq value:"csi.exe" |
ParentImage | ends_with |
| field:"ParentImage" kind:ends_with |