JScript Compiler Execution

Status: test
Severity: low
Log source: category process_creation, product windows
Author: frack113
Source: github.com/SigmaHQ/sigma

Detects the execution of the "jsc.exe" (JScript Compiler). Attacker might abuse this in order to compile JScript files on the fly and bypassing application whitelisting.

Known false positives

Legitimate use to compile JScript by developers.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1127` Trusted Developer Utilities Proxy Execution
Stealth	`T1127` Trusted Developer Utilities Proxy Execution

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: JScript Compiler Execution
id: 52788a70-f1da-40dd-8fbd-73b5865d6568
status: test
description: |
    Detects the execution of the "jsc.exe" (JScript Compiler).
    Attacker might abuse this in order to compile JScript files on the fly and bypassing application whitelisting.
references:
    - https://lolbas-project.github.io/lolbas/Binaries/Jsc/
    - https://www.phpied.com/make-your-javascript-a-windows-exe/
    - https://twitter.com/DissectMalware/status/998797808907046913
author: frack113
date: 2022-05-02
modified: 2024-04-24
tags:
    - attack.execution
    - attack.stealth
    - attack.t1127
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        - Image|endswith: '\jsc.exe'
        - OriginalFileName: 'jsc.exe'
    condition: selection
falsepositives:
    - Legitimate use to compile JScript by developers.
# Note: Can be decreased to informational or increased to medium depending on how this utility is used.
level: low

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    - Image|endswith: '\jsc.exe'
    - OriginalFileName: 'jsc.exe'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`\jsc.exe`	`field:"Image" kind:ends_with value:"\jsc.exe"`
`OriginalFileName`	eq	`jsc.exe` corpus 2 (sigma 1, elastic 1)	`field:"OriginalFileName" kind:eq value:"jsc.exe"`