[New WTFBin]: csc.exe

[redblueops]

• **Contributor Name: Alexandros Pappas (redblueops)
• **Application/Executable: csc.exe
• **WTF Behavior Description: csc.exe executes encoded powerShell. csc.exe is a legitimate software component of the Microsoft .NET Framework, signed by Microsoft Corporation. It stands for Visual C# Command-Line Compiler and is used to compile C# code into executables or libraries.
• **Link to Documentation of Behavior: https://www.reddit.com/r/msp/comments/veeo2u/possible_suspicious_behavior_regarding_cscexe_and/?rdt=62119
• **Please provide any images for additional evidence. Please see attached screenshot below.
  I've censored part of the base64 parameters as decoding the text would reveal sensitive info for my org.