Windows Process Execution of F# Interpreters fsi.exe and FsiAnyCpu.exe

title: Windows Process Execution of F# Interpreters fsi.exe and FsiAnyCpu.exe
id: 893cc7ac-660d-4cd9-b682-c27fc74f8e51
status: test
description: This rule identifies process creation events where F# interpreter binaries fsi.exe (fsianycpu.exe) are executed based on image path or OriginalFileName. Attackers may use these interpreters to run F# code from scripts or inline, which can help bypass application allow/block controls and achieve command execution. Telemetry relies on Windows process creation logs capturing the executable path and OriginalFileName attributes.
references:
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac
  - https://bohops.com/2020/11/02/exploring-the-wdac-microsoft-recommended-block-rules-part-ii-wfc-fsi/
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/FsiAnyCpu/
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Fsi/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_fsi_fsharp_code_execution.yml
author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io, Huntrule Team
date: 2022-06-02
modified: 2024-04-23
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith:
        - \fsi.exe
        - \fsianycpu.exe
    - OriginalFileName:
        - fsi.exe
        - fsianycpu.exe
  condition: selection
falsepositives:
  - Legitimate use by a software developer.
level: medium
license: DRL-1.1
related:
  - id: b96b2031-7c17-4473-afe7-a30ce714db29
    type: derived