Techniques
Sample rules
Cscript/Wscript Potentially Suspicious Child Process
- source: sigma
- technicques:
Description
Detects potentially suspicious child processes of Wscript/Cscript. These include processes such as rundll32 with uncommon exports or PowerShell spawning rundll32 or regsvr32. Malware such as Pikabot and Qakbot were seen using similar techniques as well as many others.
Detection logic
condition: selection_parent and ( selection_cli_standalone or (selection_cli_script_main
and 1 of selection_cli_script_option_*) ) and not 1 of filter_main_*
filter_main_rundll32_known_exports:
CommandLine|contains:
- UpdatePerUserSystemParameters
- PrintUIEntry
- ClearMyTracksByProcess
Image|endswith: \rundll32.exe
selection_cli_script_main:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
selection_cli_script_option_mshta:
CommandLine|contains|all:
- mshta
- http
selection_cli_script_option_other:
CommandLine|contains:
- rundll32
- regsvr32
- msiexec
selection_cli_standalone:
Image|endswith: \rundll32.exe
selection_parent:
ParentImage|endswith:
- \wscript.exe
- \cscript.exe