Rcsi.exe.md

Rcsi.exe

rcsi.exe bypass.csx
Use embedded C# within the csx script to execute the code.

• Windows binary: False

• Bypasses Default AppLocker Rules: False

• Mitre:

• Links:

  • https://enigma0x3.net/2016/11/21/bypassing-application-whitelisting-by-using-rcsi-exe/

• File path:

  • C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\cdb.exe
  • C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\cdb.exe

• Acknowledgement:

  • Name: Matt Nelson
    • Twitter: @enigma0x3
    • Blog: https://enigma0x3.net/

OS: