Runscripthelper.exe

Execute the PowerShell script with .txt extension

Use Bypass constrained language mode and execute Powershell script

runscripthelper.exe surfacecheck \\?\{PATH_ABSOLUTE:.txt} {PATH_ABSOLUTE:folder}

Context

user

Native

Execute

MITRE

T1218

Detection

Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_runscripthelper.yml

BlockRule: docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules

IOC: Event ID 4104 - Microsoft-Windows-PowerShell/Operational

IOC: Event ID 400 - Windows PowerShell

Refs

posts.specterops.io/bypassing-application-whitelisting-with-runscripthelper-exe-1906923658fc

lolbas-project.github.io/lolbas/Binaries/Runscripthelper/