Execution of a Windows Script with Unusual File Extension

[rule]
description = """
Identifies the execution of a script with an unusual file extension by Windows Script Host processes (cscript or
wscript).
"""
id = "b76c0a04-b504-4a2f-a0cf-b4175a2f3eea"
license = "Elastic License v2"
name = "Execution of a Windows Script with Unusual File Extension"
os_list = ["windows"]
version = "1.0.36"

query = '''
process where event.action == "start" and
 (process.pe.original_file_name :"wscript.exe" or process.name : "wscript.exe") and process.parent.name != null and
 process.args : ("-e:*", "/e:*", "//e:*") and
 not process.command_line : ("*.js*", "*.vb*", "*.wsf*", "*.wsh*", "*.wsc*", "*.tmp*") and
 /* Issue #286 */
 not process.parent.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe") and 
 not process.command_line : ("*:\\Program Files\\*", "*:\\Program Files (x86)\\*", "*\\Windows\\system32\\spool\\DRIVERS\\*") and
 not (process.name : "cscript.exe" and process.args : "C:\\PGM_TC~1\\DHL_FR~1\\xls2csv.bat") and
 not (process.args : "\\\\*" and process.args_count >= 3) and
 not (process.args : "/mts/wav/adf" and process.args : "/emf") and
 not (process.parent.args : "D:\\*.cmd" and process.args : "https://app.*:444/api/Banner") and
 not (process.parent.name : "cmd.exe" and process.parent.command_line : ("\"C:\\windows\\system32\\cmd.exe\" ", "cmd ")) and
 not (process.parent.name : "cmd.exe" and
       process.parent.args :
            ("C:\\ProgramData\\NinjaRMMAgent\\scripting\\customscript_gen_?.bat-ninjascript.bat",
             "C:\\Storage\\VisualStudioProjects\\connect_wise_script\\install_speerity.bat",
             "C:\\PGM_TC~1\\DHL_FR~1\\xls2csv.bat",
             "C:\\MBS\\UTIL\\repl.bat",
             "C:\\MBS\\UTIL\\PBSCOVER.BAT",
             "M:\\sendkeys.bat Mayer",
             "F:\\wamp64\\www\\centralstores\\cronjobs\\*.bat"))
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.005"
name = "Visual Basic"
reference = "https://attack.mitre.org/techniques/T1059/005/"

[[threat.technique.subtechnique]]
id = "T1059.007"
name = "JavaScript"
reference = "https://attack.mitre.org/techniques/T1059/007/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "7.15.0"