Windows Visual Basic vbc.exe Compiles to .obj via cvtres.exe Resource Converter
Alerts when vbc.exe spawns cvtres.exe during Windows VB command-line compilation activity.
- Product
- windows
- Category
- process_creation
- Author
- Ensar Şamil, @sblmsrsn, @oscd_initiative (SigmaHQ), DRL 1.1
- Published
- 2020-10-07
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process executions where vbc.exe (Visual Basic Command Line Compiler) uses cvtres.exe (Windows Resource to Object Converter). Attackers may leverage this compilation and resource conversion workflow to build or package components while staying within legitimate developer tooling. Detection relies on process creation telemetry that captures the parent and child process executable paths ending in \\vbc.exe and \\cvtres.exe.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Visual Basic vbc.exe Compiles to .obj via cvtres.exe Resource Converter
id: 70e09f85-fb96-4d4d-8c21-73b33b1e93cd
status: test
description: This rule identifies process executions where vbc.exe (Visual Basic Command Line Compiler) uses cvtres.exe (Windows Resource to Object Converter). Attackers may leverage this compilation and resource conversion workflow to build or package components while staying within legitimate developer tooling. Detection relies on process creation telemetry that captures the parent and child process executable paths ending in \\vbc.exe and \\cvtres.exe.
references:
- https://lolbas-project.github.io/lolbas/Binaries/Vbc/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_visual_basic_compiler.yml
author: Ensar Şamil, @sblmsrsn, @oscd_initiative, Huntrule Team
date: 2020-10-07
modified: 2021-11-27
tags:
- attack.stealth
- attack.t1027.004
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \vbc.exe
Image|endswith: \cvtres.exe
condition: selection
falsepositives:
- Utilization of this tool should not be seen in enterprise environment
level: high
license: DRL-1.1
related:
- id: 7b10f171-7f04-47c7-9fa2-5be43c76e535
type: derived