Files
blue-team-tools/rules/windows/process_creation/proc_creation_win_lolbin_jsc.yml
T
2022-10-28 15:06:36 +02:00

23 lines
615 B
YAML

title: JSC Convert Javascript To Executable
id: 52788a70-f1da-40dd-8fbd-73b5865d6568
status: experimental
description: Detects the execution of the LOLBIN jsc.exe used by .NET to compile javascript code to .exe or .dll format
references:
- https://lolbas-project.github.io/lolbas/Binaries/Jsc/
author: frack113
date: 2022/05/02
tags:
- attack.defense_evasion
- attack.t1127
logsource:
product: windows
category: process_creation
detection:
selection:
Image|endswith: '\jsc.exe'
CommandLine|contains: '.js'
condition: selection
falsepositives:
- Unknown
level: medium