Fsi.exe

64-bit FSharp (F#) Interpreter included with Visual Studio and DotNet Core SDK.

AWL Bypass

Execute payload with Microsoft signed binary to bypass WDAC policies

fsi.exe {PATH:.fsscript}

Execute F# code via script file — MITRE: T1059 — Privileges: User

Execute payload with Microsoft signed binary to bypass WDAC policies

fsi.exe

Execute F# code via interactive command line — MITRE: T1059 — Privileges: User