Windows Process Execution of F# Interpreters (Fsi.exe, FsiAnyCpu.exe)
Flags execution of F# interpreter binaries fsi.exe and fsianycpu.exe on Windows.
- Product
- windows
- Category
- process_creation
- Author
- Christopher Peacock @SecurePeacock, SCYTHE @scythe_io (SigmaHQ), DRL 1.1
- Published
- 2022-06-02
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation events where the executed binary is the F# interpreter, specifically Fsi.exe (Fsi.exe / fsianycpu.exe) or FsiAnyCpu.exe (fsianycpu.exe). Such interpreters can enable execution of F# code from scripts or inline content, which attackers may use to run code within a Windows environment. It relies on process creation telemetry, matching on the executable path ending with the interpreter names and the OriginalFileName values.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac
- bohops.comhttps://bohops.com/2020/11/02/exploring-the-wdac-microsoft-recommended-block-rules-part-ii-wfc-fsi/
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/OtherMSBinaries/FsiAnyCpu/
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/OtherMSBinaries/Fsi/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_fsi_fsharp_code_execution.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Process Execution of F# Interpreters (Fsi.exe, FsiAnyCpu.exe)
id: 893cc7ac-660d-4cd9-b682-c27fc74f8e51
status: test
description: This rule flags process creation events where the executed binary is the F# interpreter, specifically Fsi.exe (Fsi.exe / fsianycpu.exe) or FsiAnyCpu.exe (fsianycpu.exe). Such interpreters can enable execution of F# code from scripts or inline content, which attackers may use to run code within a Windows environment. It relies on process creation telemetry, matching on the executable path ending with the interpreter names and the OriginalFileName values.
references:
- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac
- https://bohops.com/2020/11/02/exploring-the-wdac-microsoft-recommended-block-rules-part-ii-wfc-fsi/
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/FsiAnyCpu/
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Fsi/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_fsi_fsharp_code_execution.yml
author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io, Huntrule Team
date: 2022-06-02
modified: 2024-04-23
tags:
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection:
- Image|endswith:
- \fsi.exe
- \fsianycpu.exe
- OriginalFileName:
- fsi.exe
- fsianycpu.exe
condition: selection
falsepositives:
- Legitimate use by a software developer.
level: medium
license: DRL-1.1
related:
- id: b96b2031-7c17-4473-afe7-a30ce714db29
type: derived