LOLBAS. GitHub
LIVING OFF THE LAND / OTHER MICROSOFT BINARIES

Fsi.exe

View source

64-bit FSharp (F#) Interpreter included with Visual Studio and DotNet Core SDK.

AWL Bypass
02COMMAND EXAMPLES
01ATT&CK TECHNIQUES
04DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

AWL Bypass2

EXAMPLE 01T1059

Execute F# code via script file

COMMAND
fsi.exe {PATH:.fsscript}
USE CASE
Execute payload with Microsoft signed binary to bypass WDAC policies
PRIVILEGES
User
OPERATING SYSTEM
Windows 10 2004 (likely previous and newer versions as well)
Execute · FSharp
EXAMPLE 02T1059

Execute F# code via interactive command line

COMMAND
fsi.exe
USE CASE
Execute payload with Microsoft signed binary to bypass WDAC policies
PRIVILEGES
User
OPERATING SYSTEM
Windows 10 2004 (likely previous and newer versions as well)
Execute · FSharp
02 / ON DISK

Known paths

C:\Program Files\dotnet\sdk\<version>\FSharp\fsi.exe
C:\Program Files (x86)\Microsoft Visual Studio\2019\Professional\Common7\IDE\CommonExtensions\Microsoft\FSharp\fsi.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

4 resources

Indicators & detection notes

  • IOC

    Fsi.exe execution may be suspicious on non-developer machines

REFERENCE IMPLEMENTATIONS

Code samples

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Nick Tyrer@NickTyrer
Jimmy@bohops