scriptrunner.exe

LOLBAS Execute 10 Sigma rules name it 2 ATT&CK techniques 2 documented commands 7 known copies with hashes

How scriptrunner.exe is abused

documented by LOLBAS

Execute T1202 Indirect Command Execution

-appvscript

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for scriptrunner.exe.

2 documented commands

from LOLBAS, each read by the identifier

Execute T1202 Indirect Command Execution User privileges

Executes executable

Scriptrunner.exe -appvscript {PATH:.exe}

Identify

Trips 1 Sigma rule: mediumUse of Scriptrunner.exe by Nasreddine Bencherchali (Nextron Systems)

Execute T1218 System Binary Proxy Execution User privileges

Executes cmd file from remote server

ScriptRunner.exe -appvscript {PATH_SMB:.cmd}

Identify

Trips 1 Sigma rule: mediumUse of Scriptrunner.exe by Nasreddine Bencherchali (Nextron Systems)

All 2 commands the identifier reads trip a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for scriptrunner.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for scriptrunner.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

mediumUse of Scriptrunner.exeNasreddine Bencherchali (Nextron Systems)

highPaperCut MF/NG Potential ExploitationNasreddine Bencherchali (Nextron Systems), Huntress DE&TH Team (idea)

highSuspicious Shells Spawn by Java Utility KeytoolAndreas Hunkeler (@Karneades)

highSuspicious Processes Spawned by Java.EXEAndreas Hunkeler (@Karneades), Florian Roth

highSuspicious Microsoft OneNote Child ProcessTim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Elastic (idea)

highSuspicious Outlook Child ProcessMichael Haag, Florian Roth (Nextron Systems), Markus Neis, Elastic, FPT.EagleEye Team

highSuspicious Microsoft Office Child ProcessFlorian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io

highSuspicious Serv-U Process PatternFlorian Roth (Nextron Systems)

mediumPotentially Suspicious PowerShell Child ProcessesFlorian Roth (Nextron Systems), Tim Shelton

mediumPotentially Suspicious Execution Of PDQDeployRunnerNasreddine Bencherchali (Nextron Systems)

T1202Indirect Command Execution

T1218System Binary Proxy Execution

Is it the real scriptrunner.exe?

file version info and known copies

Installed inC:\Windows\system32\

Signed byMicrosoft Windows

ProductMicrosoft (R) Windows (R) Operating System, Microsoft Corporation

7 known copies

10.0.22000.282 · C:\WINDOWS\system32\ScriptRunner.exe · signed by Microsoft Windows

d6f41e2ee1a83e96eb6d0d24e1f924673f3c5df51579d8567504e0e15d4c9deb

10.0.19041.1320 · C:\Windows\system32\ScriptRunner.exe · signed by Microsoft Windows

cec586a2e642d02e441d46ec48ea90825b506a38877312dd66c8824bf556d4c3

10.0.19041.488 · C:\Windows\system32\ScriptRunner.exe · signed by Microsoft Windows

267d6422a1ae5e633a04129388fc8bec82fd751e0130e5998f1168befec38058

10.0.19041.264 · C:\Windows\system32\ScriptRunner.exe · signed by Microsoft Windows

24f4845c08b5629c78de41c46411404ec822390f54431205e66d212e620e4f64

10.0.18362.815 · C:\WINDOWS\system32\ScriptRunner.exe · signed by Microsoft Windows

973a32dd7cc4fae82a5a5a86f61d3cc5bf8c8c8d4b3c9d0acc392398780e33dc

10.0.17763.1 · C:\Windows\system32\ScriptRunner.exe · signed by Microsoft Windows

9faac81785c13368908c6a64c0a0b88d58060cf9f0148717ea3deb64add1a874

10.0.14393.0 · C:\Windows\system32\ScriptRunner.exe · signed by Microsoft Windows

d6d5e0964dad6114840ecb51cb7a56f9d4f8a71c53a5e0a6c3c7325eb44a2292

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.