Cleaned up signature descriptions and metadata.

queries/windows/csc_compile_after_delivery.yml

@@ -0,0 +1,18 @@
+title: CSC Compile After Delivery
+description: Detect specific compilation of executables as well as dynamic
+  compilation through detection of csc.exe creating executable files (both dll and
+  exe). 
+author: keyboardcrunch
+date: 10/10/2020
+modified: 05/12/2020
+mitre:
+   tactic: Defense Evasion
+   technique: T1027
+   subtechnique: 004
+operating_system: windows
+query: (TgtProcName = "csc.exe" AND SrcProcCmdLine Contains "/target:exe") OR (SrcProcName  =
+  "csc.exe" AND TgtFileIsExecutable = "true" AND SrcProcParentName Not In ("svchost.exe"))
+false_positives: 
+   - Absolute/Computrace software.
+tags: null
+