Windows Visual Basic Compiler Using cvtres.exe Resource Converter

Alerts when vbc.exe spawns cvtres.exe during Windows VB command-line compilation activity.

FreeUnreviewedSigmahighv1

windows-visual-basic-compiler-using-cvtres-exe-resource-converter-7b10f171

title: Windows Visual Basic Compiler Using cvtres.exe Resource Converter
id: 70e09f85-fb96-4d4d-8c21-73b33b1e93cd
status: test
description: This rule flags successful executions where the Visual Basic command-line compiler (vbc.exe) invokes the Windows Resource to Object Converter (cvtres.exe). Attackers can leverage this toolchain to compile or package resources as part of payload preparation while operating within normal-looking compiler activity. The detection relies on process creation telemetry, specifically the parent process ending with vbc.exe and the child process ending with cvtres.exe.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Vbc/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_visual_basic_compiler.yml
author: Ensar Şamil, @sblmsrsn, @oscd_initiative, Huntrule Team
date: 2020-10-07
modified: 2021-11-27
tags:
  - attack.stealth
  - attack.t1027.004
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \vbc.exe
    Image|endswith: \cvtres.exe
  condition: selection
falsepositives:
  - Utilization of this tool should not be seen in enterprise environment
level: high
license: DRL-1.1
related:
  - id: 7b10f171-7f04-47c7-9fa2-5be43c76e535
    type: derived

What it detects

This rule flags successful executions where the Visual Basic command-line compiler (vbc.exe) invokes the Windows Resource to Object Converter (cvtres.exe). Attackers can leverage this toolchain to compile or package resources as part of payload preparation while operating within normal-looking compiler activity. The detection relies on process creation telemetry, specifically the parent process ending with vbc.exe and the child process ending with cvtres.exe.

Known false positives

Utilization of this tool should not be seen in enterprise environment

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.