Windows: Jlaive In-Memory Assembly Execution via Copied Batch Executable

Detects chained cmd/.bat staging that uses xcopy plus PowerShell/pwsh and attrib +h/+s to run a .bat.exe payload associated with Jlaive.

FreeReviewedSigma · Medium · v2

Product: windows
Category: process_creation
Author: Jose Luis Sanchez Martinez (@Joseliyo_Jstnk) (SigmaHQ), DRL 1.1
Published: 2022-05-24
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1059.003Windows Command Shell
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule matches a Windows process tree where a cmd.exe parent running a .bat script launches xcopy. The launched xcopy process includes PowerShell or pwsh.exe and copies a file ending with .bat.exe, and it also looks for attrib.exe usage that sets the +s and +h attributes on the same .bat.exe. This pattern is indicative of staging and executing code in-memory using a tool like Jlaive, which attackers use to reduce on-disk artifacts and evade detection. Telemetry relies on Windows process creation events, including Image and CommandLine details for cmd.exe, xcopy.exe, and attrib.exe.

Reporting behind it

Related detections9 linkedT1059.003 — drag to rearrange

Suspicious IP Release and Renew via Minimized cmd During Driver Install

Malicious IIS Worker Spawning nslookup via WS_FTP Deserialization

Malicious Metasploit Reverse Shell Injection in SQL Server (via process_creation)

Suspicious Fake Crypto Wallet Installer Batch Script Staging (via file_event)

Obfuscated Encoded PowerShell Payload Deployed via Process Execution (via process_creation)

Operator Bloopers Cobalt Strike Modules

Malicious KB Document Masqueraded Executable Spawned by Script Interpreter via RoKRAT Loader (via process_creation)

Malicious SCMBanker ClickFix Payload Fetch via Curl Piped to Cmd

Malicious Payload Assembly via MZ Header Prepend and copy Concatenation (via process_creation)

Windows: Jlaive In-Memory Assembly Execution via Copied Batch Executable

Pivot detection · T1059.003 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-jlaive-in-memory-assembly-execution-via-powershell-and--0a99eb3e

title: "Windows: Jlaive In-Memory Assembly Execution via Copied Batch Executable"
id: 32495855-d083-4aef-a213-357f99736f2f
status: test
description: This rule matches a Windows process tree where a cmd.exe parent running a .bat script launches xcopy. The launched xcopy process includes PowerShell or pwsh.exe and copies a file ending with .bat.exe, and it also looks for attrib.exe usage that sets the +s and +h attributes on the same .bat.exe. This pattern is indicative of staging and executing code in-memory using a tool like Jlaive, which attackers use to reduce on-disk artifacts and evade detection. Telemetry relies on Windows process creation events, including Image and CommandLine details for cmd.exe, xcopy.exe, and attrib.exe.
references:
  - https://jstnk9.github.io/jstnk9/research/Jlaive-Antivirus-Evasion-Tool
  - https://web.archive.org/web/20220514073704/https://github.com/ch2sh/Jlaive
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_jlaive_batch_execution.yml
author: Jose Luis Sanchez Martinez (@Joseliyo_Jstnk), Huntrule Team
date: 2022-05-24
modified: 2023-02-22
tags:
  - attack.execution
  - attack.t1059.003
logsource:
  product: windows
  category: process_creation
detection:
  parent_selection:
    ParentImage|endswith: \cmd.exe
    ParentCommandLine|endswith: .bat
  selection1:
    Image|endswith: \xcopy.exe
    CommandLine|contains|all:
      - powershell.exe
      - .bat.exe
  selection2:
    Image|endswith: \xcopy.exe
    CommandLine|contains|all:
      - pwsh.exe
      - .bat.exe
  selection3:
    Image|endswith: \attrib.exe
    CommandLine|contains|all:
      - +s
      - +h
      - .bat.exe
  condition: parent_selection and (1 of selection*)
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 0a99eb3e-1617-41bd-b095-13dc767f3def
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL