Windows JScript compiler (jsc.exe) process execution

Identifies execution of jsc.exe (JScript Compiler) from Windows process creation logs.

FreeUnreviewedSigmalowv1

windows-jscript-compiler-jsc-exe-process-execution-52788a70

title: Windows JScript compiler (jsc.exe) process execution
id: 5f2e239c-c031-4619-8b84-1b896c44432b
status: test
description: This rule flags process creation events where the executed binary is jsc.exe on Windows. Attackers can use the JScript compiler to compile scripts on demand, which may help bypass certain application controls. The detection relies on Windows process creation telemetry using the executable path ending with \jsc.exe and the OriginalFileName value of jsc.exe.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Jsc/
  - https://www.phpied.com/make-your-javascript-a-windows-exe/
  - https://twitter.com/DissectMalware/status/998797808907046913
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_jsc_execution.yml
author: frack113, Huntrule Team
date: 2022-05-02
modified: 2024-04-24
tags:
  - attack.execution
  - attack.stealth
  - attack.t1127
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    - Image|endswith: \jsc.exe
    - OriginalFileName: jsc.exe
  condition: selection
falsepositives:
  - Legitimate use to compile JScript by developers.
level: low
license: DRL-1.1
related:
  - id: 52788a70-f1da-40dd-8fbd-73b5865d6568
    type: derived

What it detects

This rule flags process creation events where the executed binary is jsc.exe on Windows. Attackers can use the JScript compiler to compile scripts on demand, which may help bypass certain application controls. The detection relies on Windows process creation telemetry using the executable path ending with \jsc.exe and the OriginalFileName value of jsc.exe.

Known false positives

Legitimate use to compile JScript by developers.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.