Use of FSharp Interpreters — Detection Rule

Detects the execution of FSharp Interpreters "FsiAnyCpu.exe" and "FSi.exe" Both can be used for AWL bypass and to execute F# code via scripts or inline.

Read the full analysis on IntelFusions