Use of FSharp Interpreters (b96b2031-7c17-4473-afe7-a30ce714db29)
The FSharp Interpreters, FsiAnyCpu.exe and FSi.exe, can be used for AWL bypass and is listed in Microsoft recommended block rules.
Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
---|---|---|---|---|
Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830) | Attack Pattern | Use of FSharp Interpreters (b96b2031-7c17-4473-afe7-a30ce714db29) | Sigma-Rules | 1 |