Suspicious Use of CSharp Interactive Console — Sigma Rule

Rule metadata and linked tags

Author: Michael R. (@nahamike01). Source status: test; severity: high. Source dates: 2020-03-08 / 2022-07-14.

{
  "category": "process_creation",
  "product": "windows"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: d012aedb0d4066fc76cd1c118e3e380f73de9db197e0e74ea7e7e6819eaadb6b

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Suspicious Use of CSharp Interactive Console
id: a9e416a8-e613-4f8b-88b8-a7d1d1af2f61
status: test
description: Detects the execution of CSharp interactive console by PowerShell
references:
    - https://redcanary.com/blog/detecting-attacks-leveraging-the-net-framework/
author: Michael R. (@nahamike01)
date: 2020-03-08
modified: 2022-07-14
tags:
    - attack.execution
    - attack.stealth
    - attack.t1127
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\csi.exe'
        ParentImage|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\powershell_ise.exe'
        OriginalFileName: 'csi.exe'
    condition: selection
falsepositives:
    - Possible depending on environment. Pair with other factors such as net connections, command-line args, etc.
level: high

Original YAML and metadata in JSON

False positives

• Possible depending on environment. Pair with other factors such as net connections, command-line args, etc.

Source references

• https://redcanary.com/blog/detecting-attacks-leveraging-the-net-framework/