Suspicious rundll32/regsvr32/msiexec Child Process from Windows Script Hosts (cscript/wscript)

Alerts on wscript/cscript spawning suspicious child processes or scripts that invoke rundll32/regsvr32/msiexec.

FreeUnreviewedSigmamediumv1

suspicious-rundll32-regsvr32-msiexec-child-process-from-windows-script-hosts-csc-b6676963

title: Suspicious rundll32/regsvr32/msiexec Child Process from Windows Script Hosts (cscript/wscript)
id: f85a6e50-3101-4dab-9640-887401d53813
status: test
description: This rule flags process creation where a child process is launched by Windows Script Host executables cscript.exe or wscript.exe. It targets child processes where cmd.exe/powershell.exe are used to invoke rundll32, regsvr32, or msiexec, and also matches direct rundll32.exe execution. It relies on Windows process creation telemetry including parent image, child image, and command-line content to find these potentially abused script-execution chains.
references:
  - Internal Research
  - https://github.com/pr0xylife/Pikabot/blob/fc58126127adf0f65e78f4eec59675523f48f086/Pikabot_30.10.2023.txt
  - https://github.com/pr0xylife/Pikabot/blob/fc58126127adf0f65e78f4eec59675523f48f086/Pikabot_22.12.2023.txt
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wscript_cscript_susp_child_processes.yml
author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'), Huntrule Team
date: 2023-05-15
modified: 2024-01-02
tags:
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - \wscript.exe
      - \cscript.exe
  selection_cli_script_main:
    Image|endswith:
      - \cmd.exe
      - \powershell.exe
      - \pwsh.exe
  selection_cli_script_option_mshta:
    CommandLine|contains|all:
      - mshta
      - http
  selection_cli_script_option_other:
    CommandLine|contains:
      - rundll32
      - regsvr32
      - msiexec
  selection_cli_standalone:
    Image|endswith: \rundll32.exe
  filter_main_rundll32_known_exports:
    Image|endswith: \rundll32.exe
    CommandLine|contains:
      - UpdatePerUserSystemParameters
      - PrintUIEntry
      - ClearMyTracksByProcess
  condition: selection_parent and ( selection_cli_standalone or (selection_cli_script_main and 1 of selection_cli_script_option_*) ) and not 1 of filter_main_*
falsepositives:
  - Some false positives might occur with admin or third party software scripts. Investigate and apply additional filters accordingly.
level: medium
license: DRL-1.1
related:
  - id: b6676963-0353-4f88-90f5-36c20d443c6a
    type: derived

What it detects

This rule flags process creation where a child process is launched by Windows Script Host executables cscript.exe or wscript.exe. It targets child processes where cmd.exe/powershell.exe are used to invoke rundll32, regsvr32, or msiexec, and also matches direct rundll32.exe execution. It relies on Windows process creation telemetry including parent image, child image, and command-line content to find these potentially abused script-execution chains.

Known false positives

Some false positives might occur with admin or third party software scripts. Investigate and apply additional filters accordingly.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.