LOL · Binary

Jsc.exe

2 techniques WindowsLOLBAS GPL-3.0

Compile

Compile Windows

Use jsc.exe to compile JavaScript code stored in the provided .JS file and generate a .EXE file with the same name.

Use Compile attacker code on system. Bypass defensive counter measures.

jsc.exe {PATH:.js}

Context: user
Native: Compile
MITRE: T1127
Detection: Sigma: github.com/SigmaHQ/sigma/blob/35a7244c62820fbc5a832e50b1e224ac3a1935da/rules/windows/process_creation/proc_creation_win_lolbin_jsc.yml
IOC: Jsc.exe should normally not run a system unless it is used for development.
Refs: twitter.com/DissectMalware/status/998797808907046913
www.phpied.com/make-your-javascript-a-windows-exe/
lolbas-project.github.io/lolbas/Binaries/Jsc/

Compile

Compile Windows

Use jsc.exe to compile JavaScript code stored in the .JS file and generate a DLL file with the same name.

Use Compile attacker code on system. Bypass defensive counter measures.

jsc.exe /t:library {PATH:.js}

Context: user
Native: Compile
MITRE: T1127
Detection: Sigma: github.com/SigmaHQ/sigma/blob/35a7244c62820fbc5a832e50b1e224ac3a1935da/rules/windows/process_creation/proc_creation_win_lolbin_jsc.yml
IOC: Jsc.exe should normally not run a system unless it is used for development.
Refs: twitter.com/DissectMalware/status/998797808907046913
www.phpied.com/make-your-javascript-a-windows-exe/
lolbas-project.github.io/lolbas/Binaries/Jsc/