JSC Convert Javascript To Executable
Detects the execution of the LOLBIN jsc.exe used by .NET to compile javascript code to .exe or .dll format
Sigma rule (View on GitHub)
1title: JSC Convert Javascript To Executable
2id: 52788a70-f1da-40dd-8fbd-73b5865d6568
3status: test
4description: Detects the execution of the LOLBIN jsc.exe used by .NET to compile javascript code to .exe or .dll format
5references:
6 - https://lolbas-project.github.io/lolbas/Binaries/Jsc/
7author: frack113
8date: 2022/05/02
9tags:
10 - attack.defense_evasion
11 - attack.t1127
12logsource:
13 product: windows
14 category: process_creation
15detection:
16 selection:
17 Image|endswith: '\jsc.exe'
18 CommandLine|contains: '.js'
19 condition: selection
20falsepositives:
21 - Unknown
22level: medium
References
Related rules
- Ilasm Lolbin Use Compile C-Sharp
- Kavremover Dropped Binary LOLBIN Usage
- Node Process Executions
- Remote Thread Creation Ttdinject.exe Proxy
- Use of Remote.exe