Suspicious Csi.exe Usage

Title: Suspicious Csi.exe Usage
Status: test
Description:Csi.exe is a signed binary from Microsoft that comes with Visual Studio and provides C# interactive capabilities. It can be used to run C# code from a file passed as a parameter in command line. Early version of this utility provided with Microsoft “Roslyn” Community Technology Preview was named 'rcsi.exe'
References:
  -https://lolbas-project.github.io/lolbas/OtherMSBinaries/Csi/
  -https://lolbas-project.github.io/lolbas/OtherMSBinaries/Rcsi/
  -https://enigma0x3.net/2016/11/21/bypassing-application-whitelisting-by-using-rcsi-exe/
  -https://twitter.com/Z3Jpa29z/status/1317545798981324801
Author: Konstantin Grishchenko, oscd.community
Date: 2020-10-17
modified:2022-07-11
Tags:

• -'attack.lateral-movement'
• -'attack.execution'
• -'attack.stealth'
• -'attack.t1072'
• -'attack.t1218'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
    - Image|endswith:
      - '\csi.exe'
      - '\rcsi.exe'
    - OriginalFileName:
      - 'csi.exe'
      - 'rcsi.exe'
  selection_cli:
    Company: 'Microsoft Corporation'
  condition:all of selection*
Falsepositives:
  -Legitimate usage by software developers
Level: medium