SigmaHQ/rules/windows/process_creation/win_malware_script_dropper.yml

title: WScript or CScript Dropper
id: cea72823-df4d-4567-950c-0b579eaf0846
status: experimental
description: Detects wscript/cscript executions of scripts located in user directories
author: Margaritis Dimitrios (idea), Florian Roth (rule)
tags:
    - attack.defense_evasion
    - attack.execution
    - attack.t1064
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image:
            - '*\wscript.exe'
            - '*\cscript.exe'
        CommandLine:
            - '* C:\Users\\*.jse *'
            - '* C:\Users\\*.vbe *'
            - '* C:\Users\\*.js *'
            - '* C:\Users\\*.vba *'
            - '* C:\Users\\*.vbs *'
            - '* C:\ProgramData\\*.jse *'
            - '* C:\ProgramData\\*.vbe *'
            - '* C:\ProgramData\\*.js *'
            - '* C:\ProgramData\\*.vba *'
            - '* C:\ProgramData\\*.vbs *'
    falsepositive:
        ParentImage: '*\winzip*'
    condition: selection and not falsepositive
fields:
    - CommandLine
    - ParentCommandLine
falsepositives:
    - Winzip
    - Other self-extractors
level: high