detection.wiki

Detection rules › Kusto

Office Apps Launching Wscipt

Status
available
Severity
medium
Time window
1h
Source
github.com/Azure/Azure-Sentinel

This query was originally published in the threat analytics report, Trickbot: Pervasive & underestimated. Trickbot is a very prevalent piece of malware with an array of malicious capabilities. Originally designed to steal banking credentials, it has since evolved into a modular trojan that can deploy other malware, disable security software, and perform command-and-control (C2) operations. Trickbot is frequently spread through email. An attacker will send a target a message with an attachment containing a malicious macro. If the target enables the macro, it will write a JScript Encoded (JSE) file to disk (JScript is a Microsoft dialect of ECMAScript). The JSE file will then be launched using wscript.exe to perform a variety of malicious tasks, particularly reconnaissance. The following query detects when Office applications have launched wscript.exe to run a JSE file. See Detect rundll.exe being used for reconnaissance and command-and-control for another query related to Trickbot activity. Reference - https://attack.mitre.org/software/S0266/

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1059 Command and Scripting Interpreter, T1203 Exploitation for Client Execution
Command & ControlT1105 Ingress Tool Transfer

Event coverage

ProviderEvent/ActionTypeTitle
SysmonEvent ID 1Process creation
Security-AuditingEvent ID 4688A new process has been created.
Defender-DeviceProcessEventsanyProcess activity (any)

Rule body kusto

id: 174de33b-107b-4cd8-a85d-b4025a35453f
name: Office Apps Launching Wscipt
description: |
  This query was originally published in the threat analytics report, Trickbot: Pervasive & underestimated.
  Trickbot is a very prevalent piece of malware with an array of malicious capabilities. Originally designed to steal banking credentials, it has since evolved into a modular trojan that can deploy other malware, disable security software, and perform command-and-control (C2) operations.
  Trickbot is frequently spread through email. An attacker will send a target a message with an attachment containing a malicious macro. If the target enables the macro, it will write a JScript Encoded (JSE) file to disk (JScript is a Microsoft dialect of ECMAScript). The JSE file will then be launched using wscript.exe to perform a variety of malicious tasks, particularly reconnaissance.
  The following query detects when Office applications have launched wscript.exe to run a JSE file.
  See Detect rundll.exe being used for reconnaissance and command-and-control for another query related to Trickbot activity.
  Reference - https://attack.mitre.org/software/S0266/
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - DeviceProcessEvents
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Execution
  - Collection
  - CommandAndControl
relevantTechniques:
  - T1059
  - T1105
  - T1203
tags:
  - Trickbot
  - JSE
  - Office Applications
query: |
  DeviceProcessEvents 
  | where InitiatingProcessFileName in~ ('winword.exe', 'excel.exe', 'outlook.exe') 
  | where FileName =~ "wscript.exe" and ProcessCommandLine has ".jse"
  | extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)
  | extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), "")
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: DeviceName
      - identifier: HostName
        columnName: HostName
      - identifier: DnsDomain
        columnName: DnsDomain
  - entityType: Process
    fieldMappings:
      - identifier: ProcessId
        columnName: ProcessId
      - identifier: CommandLine
        columnName: ProcessCommandLine
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: source

DeviceProcessEvents

Stage 2: where

| where InitiatingProcessFileName in~ ('winword.exe', 'excel.exe', 'outlook.exe')

Stage 3: where

| where FileName =~ "wscript.exe" and ProcessCommandLine has ".jse"

Stage 4: extend

| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)
HostName =
ifDeviceName has "."substring(DeviceName, 0, indexof(DeviceName, '.'))
elseDeviceName

Stage 5: extend

| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), "")
DnsDomain =
ifDeviceName has "."substring(DeviceName, (indexof(DeviceName, '.') + 1))
else""

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
FileNameeq
  • wscript.exe
InitiatingProcessFileNamein
  • excel.exe corpus 8 (elastic 8)
  • outlook.exe corpus 7 (elastic 7)
  • winword.exe corpus 8 (elastic 8)
ProcessCommandLinematch
  • .jse transforms: term corpus 3 (sigma 2, kusto 1)

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

FieldSource
HostNameextend
DnsDomainextend