LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Runscripthelper.exe

View source

Execute target PowerShell script

Execute
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
02DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Execute1

EXAMPLE 01T1218

Execute the PowerShell script with .txt extension

COMMAND
runscripthelper.exe surfacecheck \\?\{PATH_ABSOLUTE:.txt} {PATH_ABSOLUTE:folder}
USE CASE
Bypass constrained language mode and execute Powershell script
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
Execute · PowerShell
02 / ON DISK

Known paths

C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.16299.15_none_c2df1bba78111118\Runscripthelper.exe
C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.16299.192_none_ad4699b571e00c4a\Runscripthelper.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

2 resources

Indicators & detection notes

  • IOC

    Event ID 4104 - Microsoft-Windows-PowerShell/Operational

  • IOC

    Event ID 400 - Windows PowerShell

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Matt Graeber@mattifestation