LOL · OtherMSBinary

rcsi.exe

2 techniquesWindowsLOLBASGPL-3.0

Execute

ExecutionWindows

Use embedded C# within the csx script to execute the code.

Use Local execution of arbitrary C# code stored in local CSX file.

rcsi.exe {PATH:.csx}

Evidence: Upstream reference
Environment: Local host
Context: user
Native: Execute
MITRE: T1127
Detection: Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_csi_execution.yml
Elastic: github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_unusual_process_network_connection.toml
Elastic: github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_network_connection_from_windows_binary.toml
BlockRule: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_csi_execution.yml
Refs: enigma0x3.net/2016/11/21/bypassing-application-whitelisting-by-using-rcsi-exe/
lolbas-project.github.io/lolbas/OtherMSBinaries/rcsi/

AWL / Policy BypassWindows

Use embedded C# within the csx script to execute the code.

Use Local execution of arbitrary C# code stored in local CSX file.

rcsi.exe {PATH:.csx}

Evidence: Upstream reference
Environment: Local host
Context: user
Native: AWL Bypass
MITRE: T1127
Detection: Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_csi_execution.yml
Elastic: github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_unusual_process_network_connection.toml
Elastic: github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_network_connection_from_windows_binary.toml
BlockRule: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_csi_execution.yml
Refs: enigma0x3.net/2016/11/21/bypassing-application-whitelisting-by-using-rcsi-exe/
lolbas-project.github.io/lolbas/OtherMSBinaries/rcsi/