{"id":"7b10f171-7f04-47c7-9fa2-5be43c76e535","title":"Visual Basic Command Line Compiler Usage","description":"Detects successful code compilation via Visual Basic Command Line Compiler that utilizes Windows Resource to Object Converter.","author":"Ensar Şamil, @sblmsrsn, @oscd_initiative","status":"test","level":"high","date":"2020-10-07","modified":"2021-11-27","tags":["attack.stealth","attack.t1027.004"],"technique_ids":["T1027.004"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Utilization of this tool should not be seen in enterprise environment"],"references":["https://lolbas-project.github.io/lolbas/Binaries/Vbc/"],"source_path":"rules/windows/process_creation/proc_creation_win_lolbin_visual_basic_compiler.yml","source_sha256":"0ae98263ac0d53d7c3e361e1b8b7dcf7ca0d482da84a0066d3f213d735221013","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_lolbin_visual_basic_compiler.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Visual Basic Command Line Compiler Usage\nid: 7b10f171-7f04-47c7-9fa2-5be43c76e535\nstatus: test\ndescription: Detects successful code compilation via Visual Basic Command Line Compiler that utilizes Windows Resource to Object Converter.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Vbc/\nauthor: 'Ensar Şamil, @sblmsrsn, @oscd_initiative'\ndate: 2020-10-07\nmodified: 2021-11-27\ntags:\n    - attack.stealth\n    - attack.t1027.004\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|endswith: '\\vbc.exe'\n        Image|endswith: '\\cvtres.exe'\n    condition: selection\nfalsepositives:\n    - Utilization of this tool should not be seen in enterprise environment\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1027.004","id":"T1027.004","name":"Compile After Delivery","page":"techniques/enterprise/T1027.004/"}],"data_path":"data/detection-rules/7b10f171-7f04-47c7-9fa2-5be43c76e535.json","kind":"sigma"}