Use of Scriptrunner.exe
The "ScriptRunner.exe" binary can be abused to proxy execution through it and bypass possible whitelisting
Sigma rule (View on GitHub)
1title: Use of Scriptrunner.exe
2id: 64760eef-87f7-4ed3-93fd-655668ea9420
3status: test
4description: The "ScriptRunner.exe" binary can be abused to proxy execution through it and bypass possible whitelisting
5references:
6 - https://lolbas-project.github.io/lolbas/Binaries/Scriptrunner/
7author: Nasreddine Bencherchali (Nextron Systems)
8date: 2022-07-01
9tags:
10 - attack.defense-evasion
11 - attack.execution
12 - attack.t1218
13logsource:
14 category: process_creation
15 product: windows
16detection:
17 selection_img:
18 - Image|endswith: '\ScriptRunner.exe'
19 - OriginalFileName: 'ScriptRunner.exe'
20 selection_cli:
21 CommandLine|contains: ' -appvscript '
22 condition: all of selection*
23falsepositives:
24 - Legitimate use when App-v is deployed
25level: medium
References
Related rules
- Arbitrary File Download Via MSOHTMED.EXE
- Arbitrary File Download Via MSPUB.EXE
- Arbitrary File Download Via PresentationHost.EXE
- Arbitrary MSI Download Via Devinit.EXE
- Binary Proxy Execution Via Dotnet-Trace.EXE