Windows JScript Compiler (jsc.exe) Process Execution

Identifies execution of jsc.exe (JScript Compiler) from Windows process creation logs.

FreeReviewedSigma · Low · v2

Product: windows
Category: process_creation
Author: frack113 (SigmaHQ), DRL 1.1
Published: 2022-05-02
Updated: 2026-07-31

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1127Trusted Developer Utilities Proxy Execution
Persistence
Priv Esc
Defense Evasion
- T1127Trusted Developer Utilities Proxy Execution
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

Identifies when the Windows JScript Compiler executable (jsc.exe) is launched. Attackers can use jsc.exe to compile JScript content dynamically, potentially helping evade application allowlisting controls. The detection relies on Windows process creation telemetry, matching the launched binary name/path ending in \jsc.exe and the process OriginalFileName value of jsc.exe.

Reporting behind it

Related detections9 linkedT1127 — drag to rearrange

Suspicious Code Compilation via Aspnet_compiler LOLBIN (via process_creation)

ArcSOC.exe Creates Suspicious Script/Executable Files on Windows

Suspicious Child Process of aspnet_compiler.exe on Windows

Suspicious aspnet_compiler.exe Execution from User or Temp Paths on Windows

Windows: Detect kavremover-related LOLBIN command-line usage

Windows node.exe Execution with -e/--eval and suspicious child process usage

Windows: Process creation involving VSIISExeLauncher.exe with -p and -a arguments

Windows Process Creation: Mftrace.exe Child Process Execution

Windows Process Creation: Remote.exe Execution

Windows JScript Compiler (jsc.exe) Process Execution

Pivot detection · T1127 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-jscript-compiler-jsc-exe-process-execution-52788a70

title: Windows JScript Compiler (jsc.exe) Process Execution
id: 5f2e239c-c031-4619-8b84-1b896c44432b
status: test
description: Identifies when the Windows JScript Compiler executable (jsc.exe) is launched. Attackers can use jsc.exe to compile JScript content dynamically, potentially helping evade application allowlisting controls. The detection relies on Windows process creation telemetry, matching the launched binary name/path ending in \jsc.exe and the process OriginalFileName value of jsc.exe.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Jsc/
  - https://www.phpied.com/make-your-javascript-a-windows-exe/
  - https://twitter.com/DissectMalware/status/998797808907046913
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_jsc_execution.yml
author: frack113, Huntrule Team
date: 2022-05-02
modified: 2024-04-24
tags:
  - attack.execution
  - attack.stealth
  - attack.t1127
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    - Image|endswith: \jsc.exe
    - OriginalFileName: jsc.exe
  condition: selection
falsepositives:
  - Legitimate use to compile JScript by developers.
level: low
license: DRL-1.1
related:
  - id: 52788a70-f1da-40dd-8fbd-73b5865d6568
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL