Detectionmediumtest

Use of FSharp Interpreters

Detects the execution of FSharp Interpreters "FsiAnyCpu.exe" and "FSi.exe" Both can be used for AWL bypass and to execute F# code via scripts or inline.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Christopher Peacock, SCYTHECreated Thu Jun 02Updated Tue Apr 23b96b2031-7c17-4473-afe7-a30ce714db29windows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        - Image|endswith:
              - '\fsi.exe'
              - '\fsianycpu.exe'
        - OriginalFileName:
              - 'fsi.exe'
              - 'fsianycpu.exe'
    condition: selection

False Positives

Legitimate use by a software developer.

References

lolbas-project.github.io

Resolving title…

lolbas-project.github.io

MITRE ATT&CK