LOLBAS. GitHub
LIVING OFF THE LAND / OTHER MICROSOFT BINARIES

rcsi.exe

View source

Non-Interactive command line inerface included with Visual Studio.

ExecuteAWL Bypass
02COMMAND EXAMPLES
01ATT&CK TECHNIQUES
04DETECTION RESOURCES
02CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

Execute1

EXAMPLE 01T1127

Use embedded C# within the csx script to execute the code.

COMMAND
rcsi.exe {PATH:.csx}
USE CASE
Local execution of arbitrary C# code stored in local CSX file.
PRIVILEGES
User
OPERATING SYSTEM
Windows
Execute · CSharp

AWL Bypass1

EXAMPLE 01T1127

Use embedded C# within the csx script to execute the code.

COMMAND
rcsi.exe {PATH:.csx}
USE CASE
Local execution of arbitrary C# code stored in local CSX file.
PRIVILEGES
User
OPERATING SYSTEM
Windows
Execute · CSharp
02 / ON DISK

Known paths

no default
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

4 resources
FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Matt Nelson@enigma0x3