Runscripthelper.exe — LOLBAS

Execute

ExecutionWindows

Execute the PowerShell script with .txt extension

Use Bypass constrained language mode and execute Powershell script

runscripthelper.exe surfacecheck \\?\{PATH_ABSOLUTE:.txt} {PATH_ABSOLUTE:folder}

Evidence: Upstream reference
Environment: Local host
Context: user
Native: Execute
MITRE: T1218
Detection: Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_runscripthelper.yml
BlockRule: docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules
IOC: Event ID 4104 - Microsoft-Windows-PowerShell/Operational
IOC: Event ID 400 - Windows PowerShell
Refs: posts.specterops.io/bypassing-application-whitelisting-with-runscripthelper-exe-1906923658fc
lolbas-project.github.io/lolbas/Binaries/Runscripthelper/