Title:Visual Basic Command Line Compiler Usage Status:test Description:Detects successful code compilation via Visual Basic Command Line Compiler that utilizes Windows Resource to Object Converter. References: -https://lolbas-project.github.io/lolbas/Binaries/Vbc/ Author: Ensar Şamil, @sblmsrsn, @oscd_initiative Date: 2020-10-07 modified:2021-11-27 Tags:
-'attack.stealth'
-'attack.t1027.004'
Logsource:
category: process_creation
product: windows
Detection: selection: ParentImage|endswith:
'\vbc.exe' Image|endswith:
'\cvtres.exe' condition:selection Falsepositives:
-Utilization of this tool should not be seen in enterprise environment Level:high
