huntrule

Windows Visual Basic vbc.exe Compiles to .obj via cvtres.exe Resource Converter

Alerts when vbc.exe spawns cvtres.exe during Windows VB command-line compilation activity.

FreeReviewedSigma · High · v2
Product
windows
Category
process_creation
Author
Ensar Şamil, @sblmsrsn, @oscd_initiative (SigmaHQ), DRL 1.1
Published
2020-10-07
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies process executions where vbc.exe (Visual Basic Command Line Compiler) uses cvtres.exe (Windows Resource to Object Converter). Attackers may leverage this compilation and resource conversion workflow to build or package components while staying within legitimate developer tooling. Detection relies on process creation telemetry that captures the parent and child process executable paths ending in \\vbc.exe and \\cvtres.exe.

Reporting behind it

Related detections5 linkedT1027.004 — drag to rearrange
Windows Process Creation: csc.exe Used for Dynamic .NET Compilation
Windows Dynamic C# Compilation Generates .cmdline Artifact
Windows: Process Creation of Dnx.EXE May Indicate Application Whitelisting Bypass
Windows: Alert on csc.exe Executing from User-Writable or Suspicious Paths
Windows: Alert on suspicious parent process spawning csc.exe
Windows Visual Basic vbc.exe Compiles to .obj via cvtres.exe Resource Converter
Pivot detection · T1027.004 · 5 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.