.. / rcsi.exe
Star

Non-Interactive command line inerface included with Visual Studio.


Paths:


Resources:
https://enigma0x3.net/2016/11/21/bypassing-application-whitelisting-by-using-rcsi-exe/

Acknowledgement:
Matt Nelson - @enigma0x3


Detection:



Execute

Use embedded C# within the csx script to execute the code.
rcsi.exe bypass.csx
Usecase:Local execution of arbitrary C# code stored in local CSX file.
Privileges required:User
OS:Windows
Mitre:T1218



AWL bypass

Use embedded C# within the csx script to execute the code.
rcsi.exe bypass.csx
Usecase:Local execution of arbitrary C# code stored in local CSX file.
Privileges required:User
OS:Windows
Mitre:T1218