Use of FSharp Interpreters

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•18

Detects the execution of FSharp Interpreters "FsiAnyCpu.exe" and "FSi.exe". These interpreters can be used by adversaries for application whitelisting bypass and to execute F# code via scripts or inline, potentially for malicious purposes.