Possible GatherNetworkInfo.VBS Recon Script Output (via file_event)

title: Possible GatherNetworkInfo.VBS Recon Script Output (via file_event)
id: 69a93e7b-1593-5f4d-b778-2262c01f84dd
status: stable
description: This rule detects creation of files which are the results of running the built-in reconnaissance script "C:\Windows\System32\gatherNetworkInfo.vbs".
references:
    - https://posts.slayerlabs.com/living-off-the-land/#gathernetworkinfovbs
    - https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government
author: Huntrule Team
date: 2026-05-24
tags:
    - attack.discovery
    - attack.t1016
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename|startswith: 'C:\Windows\System32\config'
        TargetFilename|endswith:
            - '\Hotfixinfo.txt'
            - '\netiostate.txt'
            - '\sysportslog.txt'
            - '\VmSwitchLog.evtx'
    condition: selection
falsepositives:
    - Unknown
level: medium