JScript Compiler Execution

Title: JScript Compiler Execution
Status: test
Description:Detects the execution of the "jsc.exe" (JScript Compiler). Attacker might abuse this in order to compile JScript files on the fly and bypassing application whitelisting.
References:
  -https://lolbas-project.github.io/lolbas/Binaries/Jsc/
  -https://www.phpied.com/make-your-javascript-a-windows-exe/
  -https://twitter.com/DissectMalware/status/998797808907046913
Author: frack113
Date: 2022-05-02
modified:2024-04-24
Tags:

• -'attack.execution'
• -'attack.stealth'
• -'attack.t1127'

Logsource:

• product: windows
• category: process_creation

Detection:
  selection:
Image|endswith:'\jsc.exe' OriginalFileName:'jsc.exe'   condition:selection
Falsepositives:
  -Legitimate use to compile JScript by developers.
Level: low