LOLBAS. GitHub
LIVING OFF THE LAND / OTHER MICROSOFT BINARIES

FsiAnyCpu.exe

View source

32/64-bit FSharp (F#) Interpreter included with Visual Studio.

AWL Bypass
02COMMAND EXAMPLES
01ATT&CK TECHNIQUES
02DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

AWL Bypass2

EXAMPLE 01T1059

Execute F# code via script file

COMMAND
fsianycpu.exe {PATH:.fsscript}
USE CASE
Execute payload with Microsoft signed binary to bypass WDAC policies
PRIVILEGES
User
OPERATING SYSTEM
Windows 10 2004 (likely previous and newer versions as well)
Execute · FSharp
EXAMPLE 02T1059

Execute F# code via interactive command line

COMMAND
fsianycpu.exe
USE CASE
Execute payload with Microsoft signed binary to bypass WDAC policies
PRIVILEGES
User
OPERATING SYSTEM
Windows 10 2004 (likely previous and newer versions as well)
Execute · FSharp
02 / ON DISK

Known paths

c:\Program Files (x86)\Microsoft Visual Studio\2019\Professional\Common7\IDE\CommonExtensions\Microsoft\FSharp\fsianycpu.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

2 resources

Indicators & detection notes

  • IOC

    FsiAnyCpu.exe execution may be suspicious on non-developer machines

REFERENCE IMPLEMENTATIONS

Code samples

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Nick Tyrer@NickTyrer
Jimmy@bohops