Identifier / Programs / Windows
rcsi.exe
LOLBAS Execute, AWL Bypass 1 Sigma rule name it 1 ATT&CK technique 2 documented commands
How rcsi.exe is abused
Execute T1127 Trusted Developer Utilities Proxy Execution
AWL Bypass T1127 Trusted Developer Utilities Proxy Execution
Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for rcsi.exe.
2 documented commands
Execute T1127 Trusted Developer Utilities Proxy Execution User privileges
Use embedded C# within the csx script to execute the code.
rcsi.exe {PATH:.csx}AWL Bypass T1127 Trusted Developer Utilities Proxy Execution User privileges
Use embedded C# within the csx script to execute the code.
rcsi.exe {PATH:.csx}None of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for rcsi.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for rcsi.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.