SigmaHQ/rules/windows/process_creation/win_susp_csc.yml

title: Suspicious Parent of Csc.exe
description: Detects a suspicious parent of csc.exe, which could by a sign of payload delivery
status: experimental
references:
  - https://twitter.com/SBousseaden/status/1094924091256176641
author: Florian Roth
date: 2019/02/11
tags:
  - attack.defense_evasion
  - attack.t1036
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image: '*\csc.exe*'
    ParentImage:
      - '*\wscript.exe'
      - '*\cscript.exe'
      - '*\mshta.exe'
  condition: selection
falsepositives:
  - Unkown
level: high