Detection rules › Sigma

Cscript/Wscript Uncommon Script Extension Execution

Severity
high
Author
Nasreddine Bencherchali (Nextron Systems)
Source
upstream

Detects Wscript/Cscript executing a file with an uncommon (i.e. non-script) extension

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1059.005 Command and Scripting Interpreter: Visual Basic, T1059.007 Command and Scripting Interpreter: JavaScript

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation

Stages and Predicates

Stage 1: all of selection_img

or:
Image|endswith: '\cscript.exe'
Image|endswith: '\wscript.exe'
OriginalFileName: cscript.exe
OriginalFileName: wscript.exe

Stage 2: all of selection_extension

or:
CommandLine|contains: .csv
CommandLine|contains: .dat
CommandLine|contains: .doc
CommandLine|contains: .gif
CommandLine|contains: .jpeg
CommandLine|contains: .jpg
CommandLine|contains: .png
CommandLine|contains: .ppt
CommandLine|contains: .txt
CommandLine|contains: .xls
CommandLine|contains: .xml

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • .csv corpus 2 (sigma 2)
  • .dat corpus 2 (sigma 2)
  • .doc corpus 4 (sigma 4)
  • .gif corpus 6 (sigma 6)
  • .jpeg corpus 6 (sigma 6)
  • .jpg corpus 7 (sigma 7)
  • .png corpus 7 (sigma 7)
  • .ppt corpus 4 (sigma 4)
  • .txt corpus 7 (sigma 7)
  • .xls corpus 4 (sigma 4)
  • .xml corpus 5 (sigma 5)
Imageends_with
  • \cscript.exe corpus 64 (sigma 64)
  • \wscript.exe corpus 64 (sigma 64)
OriginalFileNameeq
  • cscript.exe corpus 15 (sigma 15)
  • wscript.exe corpus 15 (sigma 15)