this detection may still generate alerts from legitimate administrative or enterprise activity, particularly in environments that rely on logon scripts, software deployment tools (e.g., sccm, intune), legacy applications, or it automation frameworks that execute scripts via cmd.exe. some organizations may also have internally developed scripts that run from user-writable directories, which can appear suspicious but are benign. additionally, environments with non-standard application installations or portable tools may trigger this detection.

Techniques

T1059.003

Sample rules

Detect Use of cmd exe to Launch Script Interpreters

source: splunk
technicques:
- T1059.003

Description

The following detects the execution of cscript.exe or wscript.exe processes spawned by cmd.exe, leveraging Endpoint Detection and Response (EDR) telemetry mapped to the Endpoint data model, with additional contextual filtering to improve fidelity and reduce false positives. It focuses on executions originating from user-writable directories such as Users, AppData, Temp, and Downloads, which are commonly abused by attackers to stage and execute malicious scripts, while excluding trusted system paths like C:\Windows\System32\ and C:\Program Files\ that are typically associated with legitimate activity. The detection also filters out service accounts (e.g., accounts ending with $ or known naming conventions) to minimize noise from automated processes and incorporates command-line context to better assess script execution patterns and identify potentially suspicious behavior.

Detection logic


| tstats `security_content_summariesonly`
  count min(_time) as firstTime
        max(_time) as lastTime

FROM datamodel=Endpoint.Processes WHERE

Processes.parent_process_name="cmd.exe"
(
    Processes.process_name IN ("cscript.exe", "wscript.exe")
    OR
    Processes.original_file_name IN ("cscript.exe", "wscript.exe")
)
NOT Processes.process IN (
    "* \"C:\\Program Files (x86)\\*",
    "* \"C:\\Program Files\\*",
    "* \"C:\\Windows\\System32\\*",
    "* \"C:\\Windows\\SysWOW64\\*",
    "* C:\\Program Files (x86)\\*",
    "* C:\\Program Files\\*",
    "* C:\\Windows\\System32\\*",
    "* C:\\Windows\\SysWOW64\\*"
)
NOT Processes.user="*$"
BY Processes.action Processes.dest Processes.original_file_name
   Processes.parent_process Processes.parent_process_exec
   Processes.parent_process_guid Processes.parent_process_id
   Processes.parent_process_name Processes.parent_process_path
   Processes.process Processes.process_exec Processes.process_guid
   Processes.process_hash Processes.process_id Processes.process_integrity_level
   Processes.process_name Processes.process_path Processes.user
   Processes.user_id Processes.vendor_product

| `drop_dm_object_name("Processes")`

| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `detect_use_of_cmd_exe_to_launch_script_interpreters_filter`