Command and Scripting Interpreter: Visual Basic T1059.005

Events covered

21 catalog events are tagged with this technique by at least one rule.

Authoring guide

Patterns shared across the 62 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (46 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

Top indicator values (533 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

Exclusions (171 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Sigma 28 rules

• Adwind RAT / JRAT
• Adwind RAT / JRAT File Artifact
• AppLocker Prevented Application or Script from Running
• Axios NPM Compromise Indicators - Windows
• Csc.EXE Execution Form Potentially Suspicious Parent
• Cscript/Wscript Uncommon Script Extension Execution
• HackTool - CACTUSTORCH Remote Thread Creation
• HackTool - Koadic Execution
• HackTool - NetExec File Indicators
• HTML Help HH.EXE Suspicious Child Process
• MMC Loading Script Engines DLLs
• Potential APT10 Cloud Hopper Activity
• Potential Dropper Script Execution Via WScript/CScript/MSHTA
• Potential QBot Activity
• Potential Reconnaissance Activity Via GatherNetworkInfo.VBS
• Potential Remote SquiblyTwo Technique Execution
• Registry Modification Attempt Via VBScript
• Registry Modification Attempt Via VBScript - PowerShell
• Registry Tampering by Potentially Suspicious Processes
• Suspicious Child Process Of BgInfo.EXE
• Suspicious HH.EXE Execution
• Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBS
• Suspicious Scripting in a WMI Consumer
• Uncommon Child Process Of BgInfo.EXE
• Windows Shell/Scripting Processes Spawning Suspicious Programs
• WScript or CScript Dropper - File
• WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
• XSL Script Execution Via WMIC.EXE

Elastic 18 rules

• Command and Scripting Interpreter via Windows Scripts
• Delayed Execution via Ping
• Execution of a Downloaded Windows Script
• Microsoft Build Engine Started by a Script Process
• Microsoft Management Console File from Unusual Path
• Remote File Download via Script Interpreter
• Remote XSL Script Execution via COM
• Scheduled Task Created by a Windows Script
• Script Execution via Microsoft HTML Application
• Script Interpreter Connection to Non-Standard Port
• Service Control Spawned via Script Interpreter
• Suspicious .NET Code Compilation
• Suspicious Explorer Child Process
• Suspicious ScreenConnect Client Child Process
• Web Shell Detection: Script Process Child of Common Web Processes
• Windows Script Executing PowerShell
• Windows Script Execution from Archive
• Windows Script Interpreter Executing Process via WMI

Splunk 15 rules

• Cisco NVM - MSHTML or MSHTA Network Execution Without URL in CLI
• Cisco NVM - Susp Script From Archive Triggering Network Activity
• Executable Process from Suspicious Folder (PowerShell)
• Executable Process from Suspicious Folder (Sysmon)
• Executable Process from Suspicious Folder (Windows Event Log)
• Execute Javascript With Jscript COM CLSID
• Microsoft Build Engine Suspicious Parent Process (Sysmon)
• Microsoft Build Engine Suspicious Parent Process (Windows Event Log)
• Suspicious Process DNS Query Known Abuse Web Services
• Suspicious Process With Discord DNS Query
• Vbscript Execution Using Wscript App
• Windows Outlook Macro Created by Suspicious Process
• Wscript_Cscript Execution (PowerShell)
• Wscript_Cscript Execution (Sysmon)
• Wscript_Cscript Execution (Windows Event Log)

Kusto 1 rule

• Script Interpreter Loading DotNet Assembly From Memory