Detectionhightest

Visual Basic Command Line Compiler Usage

Detects successful code compilation via Visual Basic Command Line Compiler that utilizes Windows Resource to Object Converter.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Ensar Şamil, @oscd_initiativeCreated Wed Oct 07Updated Sat Nov 277b10f171-7f04-47c7-9fa2-5be43c76e535windows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        ParentImage|endswith: '\vbc.exe'
        Image|endswith: '\cvtres.exe'
    condition: selection

False Positives

Utilization of this tool should not be seen in enterprise environment

References

MITRE ATT&CK

Tactics

Sub-techniques

Rule Metadata

Rule ID

7b10f171-7f04-47c7-9fa2-5be43c76e535

Status

test

Level

high

Type

Detection

Created

Wed Oct 07

Modified

Sat Nov 27

Author

Path

rules/windows/process_creation/proc_creation_win_lolbin_visual_basic_compiler.yml

Raw Tags

attack.defense-evasionattack.t1027.004