Suspicious rundll32/regsvr32/msiexec Child Process from Windows Script Hosts (cscript/wscript)
Alerts on wscript/cscript spawning suspicious child processes or scripts that invoke rundll32/regsvr32/msiexec.
FreeReviewedSigma · Medium · v1
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86') (SigmaHQ), DRL 1.1
- Published
- 2023-05-15
- Updated
- 2026-07-30
What it detects
This rule flags process creation where a child process is launched by Windows Script Host executables cscript.exe or wscript.exe. It targets child processes where cmd.exe/powershell.exe are used to invoke rundll32, regsvr32, or msiexec, and also matches direct rundll32.exe execution. It relies on Windows process creation telemetry including parent image, child image, and command-line content to find these potentially abused script-execution chains.
Reporting behind it
- Internal ResearchInternal Research
- github.comhttps://github.com/pr0xylife/Pikabot/blob/fc58126127adf0f65e78f4eec59675523f48f086/Pikabot_30.10.2023.txt
- github.comhttps://github.com/pr0xylife/Pikabot/blob/fc58126127adf0f65e78f4eec59675523f48f086/Pikabot_22.12.2023.txt
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wscript_cscript_susp_child_processes.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
suspicious-rundll32-regsvr32-msiexec-child-process-from-windows-script-hosts-csc-b6676963
title: Suspicious rundll32/regsvr32/msiexec Child Process from Windows Script Hosts (cscript/wscript)
id: f85a6e50-3101-4dab-9640-887401d53813
status: test
description: This rule flags process creation where a child process is launched by Windows Script Host executables cscript.exe or wscript.exe. It targets child processes where cmd.exe/powershell.exe are used to invoke rundll32, regsvr32, or msiexec, and also matches direct rundll32.exe execution. It relies on Windows process creation telemetry including parent image, child image, and command-line content to find these potentially abused script-execution chains.
references:
- Internal Research
- https://github.com/pr0xylife/Pikabot/blob/fc58126127adf0f65e78f4eec59675523f48f086/Pikabot_30.10.2023.txt
- https://github.com/pr0xylife/Pikabot/blob/fc58126127adf0f65e78f4eec59675523f48f086/Pikabot_22.12.2023.txt
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wscript_cscript_susp_child_processes.yml
author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'), Huntrule Team
date: 2023-05-15
modified: 2024-01-02
tags:
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \wscript.exe
- \cscript.exe
selection_cli_script_main:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
selection_cli_script_option_mshta:
CommandLine|contains|all:
- mshta
- http
selection_cli_script_option_other:
CommandLine|contains:
- rundll32
- regsvr32
- msiexec
selection_cli_standalone:
Image|endswith: \rundll32.exe
filter_main_rundll32_known_exports:
Image|endswith: \rundll32.exe
CommandLine|contains:
- UpdatePerUserSystemParameters
- PrintUIEntry
- ClearMyTracksByProcess
condition: selection_parent and ( selection_cli_standalone or (selection_cli_script_main and 1 of selection_cli_script_option_*) ) and not 1 of filter_main_*
falsepositives:
- Some false positives might occur with admin or third party software scripts. Investigate and apply additional filters accordingly.
level: medium
license: DRL-1.1
related:
- id: b6676963-0353-4f88-90f5-36c20d443c6a
type: derived