Title:Use of Scriptrunner.exe Status:test Description:The "ScriptRunner.exe" binary can be abused to proxy execution through it and bypass possible whitelisting References: -https://lolbas-project.github.io/lolbas/Binaries/Scriptrunner/ Author: Nasreddine Bencherchali (Nextron Systems) Date: 2022-07-01 modified:None Tags:
-'attack.execution'
-'attack.stealth'
-'attack.t1218'
Logsource:
category: process_creation
product: windows
Detection: selection_img: Image|endswith:'\ScriptRunner.exe'OriginalFileName:'ScriptRunner.exe'selection_cli: CommandLine|contains:
' -appvscript ' condition:all of selection* Falsepositives:
-Legitimate use when App-v is deployed Level:medium
