detection.wiki

Detection rules › Sigma

Cscript/Wscript Potentially Suspicious Child Process

Status
test
Severity
medium
Log source
product windows, category process_creation
Author
Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86')
Source
github.com/SigmaHQ/sigma

Detects potentially suspicious child processes of Wscript/Cscript. These include processes such as rundll32 with uncommon exports or PowerShell spawning rundll32 or regsvr32. Malware such as Pikabot and Qakbot were seen using similar techniques as well as many others.

MITRE ATT&CK coverage

TacticTechniques
ExecutionNo specific technique

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation
Security-AuditingEvent ID 4688A new process has been created.

Rule body yaml

title: Cscript/Wscript Potentially Suspicious Child Process
id: b6676963-0353-4f88-90f5-36c20d443c6a
status: test
description: |
    Detects potentially suspicious child processes of Wscript/Cscript. These include processes such as rundll32 with uncommon exports or PowerShell spawning rundll32 or regsvr32.
    Malware such as Pikabot and Qakbot were seen using similar techniques as well as many others.
references:
    - Internal Research
    - https://github.com/pr0xylife/Pikabot/blob/fc58126127adf0f65e78f4eec59675523f48f086/Pikabot_30.10.2023.txt
    - https://github.com/pr0xylife/Pikabot/blob/fc58126127adf0f65e78f4eec59675523f48f086/Pikabot_22.12.2023.txt
author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86')
date: 2023-05-15
modified: 2024-01-02
tags:
    - attack.execution
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\wscript.exe'
            - '\cscript.exe'
    selection_cli_script_main:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
    # Note: Add other combinations that are suspicious
    selection_cli_script_option_mshta:
        CommandLine|contains|all:
            - 'mshta'
            - 'http'
    selection_cli_script_option_other:
        CommandLine|contains:
            - 'rundll32'
            - 'regsvr32'
            - 'msiexec'
    selection_cli_standalone:
        Image|endswith: '\rundll32.exe'
    filter_main_rundll32_known_exports:
        Image|endswith: '\rundll32.exe'
        CommandLine|contains:
            - 'UpdatePerUserSystemParameters'
            - 'PrintUIEntry'
            - 'ClearMyTracksByProcess'
    condition: selection_parent and ( selection_cli_standalone or (selection_cli_script_main and 1 of selection_cli_script_option_*) ) and not 1 of filter_main_*
falsepositives:
    - Some false positives might occur with admin or third party software scripts. Investigate and apply additional filters accordingly.
level: medium

Stages and Predicates

Stage 0: condition

selection_parent and ( selection_cli_standalone or (selection_cli_script_main and 1 of selection_cli_script_option_*) ) and not 1 of filter_main_*

Stage 1: selection_parent

selection_parent:
    ParentImage|endswith:
        - '\wscript.exe'
        - '\cscript.exe'

Stage 2: selection_cli_standalone

selection_cli_standalone:
    Image|endswith: '\rundll32.exe'

Stage 3: selection_cli_script_main

selection_cli_script_main:
    Image|endswith:
        - '\cmd.exe'
        - '\powershell.exe'
        - '\pwsh.exe'

Stage 4: selection_cli_script_option_mshta

selection_cli_script_option_mshta:
    CommandLine|contains|all:
        - 'mshta'
        - 'http'

Stage 5: selection_cli_script_option_other

selection_cli_script_option_other:
    CommandLine|contains:
        - 'rundll32'
        - 'regsvr32'
        - 'msiexec'

Stage 6: not filter_main_rundll32_known_exports

filter_main_rundll32_known_exports:
    Image|endswith: '\rundll32.exe'
    CommandLine|contains:
        - 'UpdatePerUserSystemParameters'
        - 'PrintUIEntry'
        - 'ClearMyTracksByProcess'

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
CommandLinematchClearMyTracksByProcess
CommandLinematchPrintUIEntry
CommandLinematchUpdatePerUserSystemParameters
Imageends_with\rundll32.exe

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • http corpus 39 (sigma 34, elastic 2, chronicle 2, splunk 1)
  • mshta corpus 14 (sigma 14)
  • msiexec corpus 5 (sigma 5)
  • regsvr32 corpus 15 (sigma 15)
  • rundll32 corpus 26 (sigma 23, chronicle 2, kusto 1)
Imageends_with
  • \cmd.exe corpus 130 (sigma 130)
  • \powershell.exe corpus 182 (sigma 182)
  • \pwsh.exe corpus 168 (sigma 168)
  • \rundll32.exe corpus 95 (sigma 95)
ParentImageends_with
  • \cscript.exe corpus 17 (sigma 17)
  • \wscript.exe corpus 19 (sigma 19)