MalCommands

#					tactics	techniques	os

detail

Command Line

jsc.exe scriptfile.js

Description

Abuse JSC to compile scriptfile.js to EXE format, scriptfile.exe.

Risk

High

Risk Reason

For most users besides possibly developers, this would be a suspicious action.

Fidelity

High

Fidelity Reason

This is likely an extremely abnormal command for the majority of users in most organizations.

Operating Systems

Windows

Killchain Phases

Actions on Objectives

References

https://lolbas-project.github.io/lolbas/Binaries/Jsc/

TOOL DATA

Tool Name: jsc

Tool URL: N/A

Tool Description: jsc.yml is a Microsoft utility used by the .NET Framework to compile JavaScript to .exe or .dll format.

Common Tool Locations

C:\Windows\Microsoft.NET\Framework\v4.0.30319\Jsc.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Jsc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Jsc.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Jsc.exe

Common Tool Arguments

/t - Output type - use '/t:library' for a DLL instead of an EXE

MITRE ATT&CK TECHNIQUES

Technique: T1127 - Trusted Developer Utilities Proxy Execution

URL: https://attack.mitre.org/techniques/T1127

Description: Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads. There are many utilities used for software development related tasks that can be used to execute code in various forms to assist in development, debugging, and reverse engineering.(Citation: engima0x3 DNX Bypass)(Citation: engima0x3 RCSI Bypass)(Citation: Exploit Monday WinDbg)(Citation: LOLBAS Tracker) These utilities may often be signed with legitimate certificates that allow them to execute on a system and proxy execution of malicious code through a trusted process that effectively bypasses application control solutions.

Tactics:

Defense Evasion