Legitimate Application Dropped Script

Severity: high
Author: frack113, Florian Roth (Nextron Systems)
Source: upstream

Detects programs on a Windows system that should not write scripts to disk

MITRE ATT&CK coverage

Tactic	Techniques
Defense Evasion	`T1218` System Binary Proxy Execution

Event coverage

Provider	Event ID	Title
Sysmon	11	FileCreate

Stages and Predicates

Stage 1: `selection`

or:
Image|endswith: '\AcroRd32.exe'
Image|endswith: '\CertReq.exe'
Image|endswith: '\Desktopimgdownldr.exe'
Image|endswith: '\RdrCEF.exe'
Image|endswith: '\certoc.exe'
Image|endswith: '\certutil.exe'
Image|endswith: '\eqnedt32.exe'
Image|endswith: '\esentutl.exe'
Image|endswith: '\finger.exe'
Image|endswith: '\hh.exe'
Image|endswith: '\mshta.exe'
Image|endswith: '\wordpad.exe'
Image|endswith: '\wordview.exe'
or:
TargetFilename|endswith: .bat
TargetFilename|endswith: .ps1
TargetFilename|endswith: .scf
TargetFilename|endswith: .vbs
TargetFilename|endswith: .wsf
TargetFilename|endswith: .wsh

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.