Suspicious API Call via Windows Script Interpreter

[rule]
description = """
Identifies a suspicious managed code hosting process which could indicate code injection or other form of suspicious
code execution via Windows scripts.
"""
id = "58adbf08-73bd-4bd3-a74c-6b0f82d23a82"
license = "Elastic License v2"
name = "Suspicious API Call via Windows Script Interpreter"
os_list = ["windows"]
reference = ["https://github.com/med0x2e/GadgetToJScript", "https://github.com/mdsecactivebreach/SharpShooter"]
version = "1.0.5"

query = '''
api where
  process.name : ("wscript.exe", "cscript.exe", "mshta.exe", "cmstp.exe", "msxsl.exe", "mmc.exe") and
  process.Ext.api.name : ("VirtualAlloc", "MapViewOfFile*") and
  process.Ext.api.metadata.target_address_name : "?*" and process.Ext.api.parameters.protection == "RWX" and
  process.thread.Ext.call_stack_final_user_module.name in ("clr.dll", "mscoreei.dll") and
  process.thread.Ext.call_stack_summary : ("*|clr.dll|jscript*", "*|clr.dll|vbscript.dll|msxml?.dll|*") and
  not process.Ext.api.metadata.target_address_name in ("clr.dll", "gdi32full.dll") and
  process.Ext.api.parameters.size != 296 and
  not process.parent.executable :
               ("?:\\IPeople\\Script\\IPScriptDirector.exe",
                "?:\\Program Files\\Microsoft System Center\\Operations Manager\\Server\\MonitoringHost.exe",
                "?:\\Program Files\\Microsoft System Center\\Operations Manager\\Server\\MonitoringHost.exe",
                "C:\\Program Files (x86)\\DarkWebAdvisorsAgent\\PCPitstopScheduleService.exe",
                "C:\\Program Files (x86)\\TelesystemAgent\\PCPitstopScheduleService.exe") and
  not (process.executable : "C:\\Windows\\SysWOW64\\cscript.exe" and process.parent.executable : "C:\\Windows\\SysWOW64\\cmd.exe" and
       process.command_line like "cscript  //B scan.wsf *" and user.id == "S-1-5-18") and
  not (process.executable : "C:\\Windows\\System32\\mmc.exe" and
       process.thread.Ext.call_stack_summary like "ntdll.dll|*|mswb7.dll|clr.dll|jscript.dll|mmcndmgr.dll|mmc.exe*") and
  not process.command_line :
             ("\"C:\\Windows\\System32\\cscript.exe\" //B //Nologo C:\\Windows\\Options\\SWD\\MapHomeDrive_1_0_0.vbs",
              "C:\\WINDOWS\\System32\\WScript.exe \"M:\\DOH\\Data Exchange\\OCFS\\Severe Maternal Morbidity\\EGScript1.vbs\" ",
              "cscript.exe  //T:120 //U //Nologo \"C:\\Program Files (x86)\\Site24x7\\WinAgent\\monitoring\\conf\\scripts\\topprocess.vbs\" 2 ")
'''

min_endpoint_version = "8.10.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.005"
name = "Visual Basic"
reference = "https://attack.mitre.org/techniques/T1059/005/"

[[threat.technique.subtechnique]]
id = "T1059.007"
name = "JavaScript"
reference = "https://attack.mitre.org/techniques/T1059/007/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"

[[threat.technique]]
id = "T1220"
name = "XSL Script Processing"
reference = "https://attack.mitre.org/techniques/T1220/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"