Identifier / Programs / Windows

jsc.exe

jsc.exe file version info (xCyclopedia)

LOLBAS Compile 1 Sigma rule name it 1 ATT&CK technique 2 documented commands 2 known copies with hashes

How jsc.exe is abused

documented by LOLBAS

Compile T1127 Trusted Developer Utilities Proxy Execution

-t

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for jsc.exe.

2 documented commands

from LOLBAS, each read by the identifier

Compile T1127 Trusted Developer Utilities Proxy Execution User privileges

Use jsc.exe to compile JavaScript code stored in the provided .JS file and generate a .EXE file with the same name.

jsc.exe {PATH:.js}

Identify

Trips 1 Sigma rule: lowJScript Compiler Execution by frack113

Compile T1127 Trusted Developer Utilities Proxy Execution User privileges

Use jsc.exe to compile JavaScript code stored in the .JS file and generate a DLL file with the same name.

jsc.exe /t:library {PATH:.js}

Identify

Trips 1 Sigma rule: lowJScript Compiler Execution by frack113

All 2 commands the identifier reads trip a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for jsc.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for jsc.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

lowJScript Compiler Executionfrack113

T1127Trusted Developer Utilities Proxy Execution

Is it the real jsc.exe?

file version info and known copies

Installed inC:\Windows\Microsoft.NET\Framework\v4.0.30319\

Signed byMicrosoft Windows

ProductMicrosoft .NET Framework, Microsoft Corporation

Descriptionjsc.exe

2 known copies

14.8.4161.0 built by: NET48REL1 · C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\jsc.exe · signed by Microsoft Windows

ffec0de61d7accbda9d57ee5b297fcd4725e971a061da41ad0c5751c496ef6a4

14.8.4084.0 built by: NET48REL1 · C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe · signed by Microsoft Windows

39e87f0edcdd15582cfefdfab1975aadd2c7ca1e3a5f07b1146ce3206f401bb5

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.