windows enabled community low v1.0.0

vbc

Binary file used for compile vbs code Located at: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe; C:\Windows\Microsoft.NET\Framework\v3.5\vbc.exe; C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe.

📋 Live Preview

vbc

vbc

Sandbox: execFile · Timeout: 30s

Capabilities

build.compile.code

Contract

Outputs

process.output

Command execution output

Side effects: process_spawn

Workflow Edges

Produces

process.output

Resource Profile

Resource	Value
CPU	low
Memory	16 MB
Network	low
Disk I/O	low

Examples

Binary file used by .NET to compile Visual Basic code to an executable. (Compile attacker code on system. Bypass defensive counter measures.)

vbc.exe /target:exe {PATH_ABSOLUTE:.vb}

Binary file used by .NET to compile Visual Basic code to an executable. (Compile attacker code on system. Bypass defensive counter measures.)

vbc -reference:Microsoft.VisualBasic.dll {PATH_ABSOLUTE:.vb}

Detection

Type	Rule / Indicator
sigma	https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_visual_basic_compiler.yml
elastic	https://github.com/elastic/detection-rules/blob/61afb1c1c0c3f50637b1bb194f3e6fb09f476e50/rules/windows/defense_evasion_dotnet_compiler_parent_process.toml

Documentation

vbc

vbc is a Windows LOLBin. Binary file used for compile vbs code Located at: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe; C:\Windows\Microsoft.NET\Framework\v3.5\vbc.exe; C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe.