Execution of a Windows Script File Written by a Suspicious Process

[rule]
description = """
Identifies the execution of a script file written by a suspicious application. Script interpreters are often launched
during exploitation of Office applications or from documents containing malicious macros.
"""
id = "dc9c8c7c-f398-401f-804a-325570a5f167"
license = "Elastic License v2"
name = "Execution of a Windows Script File Written by a Suspicious Process"
os_list = ["windows"]
version = "1.0.34"

query = '''
sequence by user.id with maxspan=5m

 [file where event.action == "creation" and file.path : "C:\\*" and

   file.extension : ("hta", "vbs", "js", "wsf", "vbe", "jse") and not user.id : "S-1-5-18" and

   not (process.code_signature.subject_name :
            ("AUTO/MATE, INC.", "TeamViewer*", "KOBIL Systems GmbH", "Ratiborus MSFree Inc.",
             "Canon Electronics Inc.", "Johannes Schindelin", "Bomgar Corporation", "PFU LIMITED",
             "Learnpulse", "Azul Systems, Inc.") and
        process.code_signature.trusted == true) and
   not process.executable :
              ("?:\\ProgramData\\Microsoft\\VisualStudio\\Packages\\*.exe",
               "?:\\Program Files\\SWSetup\\SP100309\\Lexus FW Upgrade 0007.exe", 
               "?:\\Program Files (x86)\\Imprivata\\OneSign Agent\\x64\\ISXAgent.exe") and

   not (process.executable : "?:\\Users\\*\\AppData\\Roaming\\zozi-rpa-engine\\openjdk\\bin\\java.exe" and
        file.path : "C:\\Project\\*.vbs") and

   not file.path : "C:\\WINDOWS\\TEMP\\*.vbs" and

   not file.Ext.header_bytes :
                 ("0d0a272d2d2d2d2d2d2d2d2d2d2d2d2d", "272a2a2a2a2a2a2a2a2a2a2a2a2a2a2a",
                  "4966204e6f742049734f626a65637428", "4f6e204572726f7220526573756d6520",
                  "53657420554143203d20437265617465", "53006500740020006f0062006a004600",
                  "53006500740020005500410043002000", "4f4e204552524f5220524553554d4520",
                  "4372656174654f626a65637428225773") and

   (
     process.name : ("winword.exe", "excel.exe", "outlook.exe", "powerpnt.exe", "eqnedt32.exe", "fltldr.exe",
                     "mspub.exe", "msaccess.exe", "certutil.exe", "tar.exe", "CertReq.exe", "xcopy.exe", 
                     "cmd.exe", "powershell.exe", "mshta.exe", "curl.exe", "pwsh.exe", "rundll32.exe", 
                     "regsvr32.exe") or

     (process.code_signature.trusted == false or process.code_signature.exists == false) or

     process.executable : ("?:\\Users\\*\\AppData\\*", "?:\\ProgramData\\*", "?:\\Users\\Public\\*")
   )] as event0

 [process where event.action == "start" and
  process.name : ("wscript.exe", "mshta.exe") and
  startswith~(process.args, event0.file.path) and
  not (process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*") and process.args_count <= 3) and
  not (process.name : "wscript.exe" and process.parent.name : "cmd.exe" and
       process.parent.command_line : ("*Desktop\\PROTECTAgentInstaller.bat*", "*cleanupSetup.vbs Shell_*.log*")) and
  not process.parent.executable :
                    ("?:\\Program Files (x86)\\Virus Chaser\\pcms\\patch\\_incomming_files\\KDB_Trellix_Agent_BG.sfx.exe",
                     "?:\\Program Files (x86)\\UPS\\CrossWare\\CrossWare.exe",
                     "?:\\Program Files\\UPS\\CrossWare\\CrossWare.exe",
                     "?:\\Program Files (x86)\\Common Files\\InstallShield\\Driver\\8\\Intel 32\\IDriver.exe") and
  not (process.parent.args : "-no_selfdeleter" and process.parent.args : "-IS_temp") and
  not (process.parent.args : "-removeonly" and process.parent.args : "-runfromtemp") and
  not (process.name : "wscript.exe" and process.parent.name : "cmd.exe" and
       process.parent.args : ("?:\\PROGRA~2\\Baxter\\*\\REGIST~1.BAT", "PrepStation\\registerCameraStand.bat", "?:\\Program Files (x86)\\Baxter\\*")) and
  not (process.parent.args : "http*://*:8282/dataloader/*" and process.args : "?:\\Windows\\TEMP\\Spiceworks\\spiceworks_upload.vbs") and
  not (process.parent.args : "C:\\XperCon\\_Xtra\\PDF_Rename\\pdf_rename.bat" and process.args : "C:\\XperCon\\_Xtra\\PDF_Rename\\transform.vbs") and
  not (process.parent.args : "C:\\CSM Infopath Templates\\Register CSM InfoPath Templates.exe" and process.args : "C:\\CSM Infopath Templates\\installAllTemplates.vbs") and
  not (process.parent.name : "cmd.exe" and process.parent.args : "%TEMP%\\Spiceworks\\*") and
  not (process.name : "mshta.exe" and process.parent.name : "mshta.exe"  and process.parent.args : "\\\\*\\netlogon\\ADSelfService_Enroll.hta") and
  not (process.parent.name : "JustWareSmartClient.exe" and process.executable : "C:\\Windows\\SysWOW64\\wscript.exe") and

  /* FP - contentACCESS (TECH-ARROW) Outlook email archiving add-in */
  not process.args : "?:\\Users\\*\\AppData\\Local\\Temp\\contentACCESSForm\\RunAction.vbs" and

  /* FP - domain login scripts dropping uacinstall.vbs via netlogon */
  not (process.parent.name : "cmd.exe" and process.parent.args : "\\\\*\\netlogon\\*" and
       process.args : "*\\uacinstall.vbs")
  ]
'''

min_endpoint_version = "8.4.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"

[[threat.technique.subtechnique]]
id = "T1059.005"
name = "Visual Basic"
reference = "https://attack.mitre.org/techniques/T1059/005/"

[[threat.technique.subtechnique]]
id = "T1059.007"
name = "JavaScript"
reference = "https://attack.mitre.org/techniques/T1059/007/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.005"
name = "Mshta"
reference = "https://attack.mitre.org/techniques/T1218/005/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.4.0"