Suspicious Csi.exe Usage
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Csi.exe is a signed binary from Microsoft that comes with Visual Studio and provides C# interactive capabilities. It can be used to run C# code from a file passed as a parameter in command line. Early version of this utility provided with Microsoft “Roslyn” Community Technology Preview was named 'rcsi.exe'
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Process started" AND (PROCESSNAME endswith "\csi.exe,\rcsi.exe" OR ORIGINALFILENAME = "csi.exe,rcsi.exe") AND COMPANY_NAME = "Microsoft Corporation" select Action1.HOSTNAME,Action1.MESSAGE,Action1.COMMANDLINE,Action1.FILE_NAME,Action1.PROCESSNAME,Action1.USERNAME,Action1.PARENTPROCESSNAME
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Konstantin Grishchenko, oscd.community
