Identifier / Programs / Windows

vbc.exe

Visual Basic Command Line Compiler file version info (xCyclopedia)

LOLBAS Compile 1 Sigma rule name it 2 ATT&CK techniques 2 documented commands 4 known copies with hashes

How vbc.exe is abused

documented by LOLBAS

Compile T1127 Trusted Developer Utilities Proxy Execution

-target

Compile T1127 Trusted Developer Utilities Proxy Execution

-reference

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for vbc.exe.

2 documented commands

from LOLBAS, each read by the identifier

Compile T1127 Trusted Developer Utilities Proxy Execution User privileges

Binary file used by .NET to compile Visual Basic code to an executable.

vbc.exe /target:exe {PATH_ABSOLUTE:.vb}

Identify

Compile T1127 Trusted Developer Utilities Proxy Execution User privileges

Binary file used by .NET to compile Visual Basic code to an executable.

vbc -reference:Microsoft.VisualBasic.dll {PATH_ABSOLUTE:.vb}

Identify

None of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for vbc.exe, by Lior Adar, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for vbc.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

highLummac Stealer Activity - Execution Of More.com And Vbc.exeJoseliyo Sanchez, @Joseliyo_Jstnk

T1055Process Injection

T1127Trusted Developer Utilities Proxy Execution

Is it the real vbc.exe?

file version info and known copies

Installed inC:\Windows\Microsoft.NET\Framework64\v4.0.30319\
C:\Windows\Microsoft.NET\Framework\v4.0.30319\

Signed byMicrosoft Windows

ProductMicrosoft .NET Framework, Microsoft Corporation

DescriptionVisual Basic Command Line Compiler

4 known copies

14.8.4161.0 · C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\vbc.exe · signed by Microsoft Windows

19a3cfbc90e877df30e938fb55785ac3ba8e2e30a54ffbb5af6e0ec9430f9e4b

14.8.4161.0 · C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\vbc.exe · signed by Microsoft Windows

1baea4a35daab07203753fd875d59e4058c2872a03587bf3ff933546a2ef26a8

14.8.4084.0 · C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe · signed by Microsoft Windows

23c34ff2bb98f028fefab008f83af6c74a5f7b99114e6140cd69212644bf8d3e

14.8.4084.0 · C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe · signed by Microsoft Windows

c16336ab32195b08c1678220fbe0256fee865f623e2b32fcfa4d9825fd68977e

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.