huntrule

Suspicious Script Host Spawning PowerShell With Bypass And Hidden Execution

PremiumReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-09-10
Updated
2026-09-10
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects wscript.exe or cscript.exe spawning PowerShell with execution-policy bypass and no-profile command execution flags. This chain was observed delivering NetSupport RAT where a JavaScript ActiveXObject WScript.Shell launched PowerShell to fetch the payload. Script hosts invoking hidden bypass PowerShell is a common loader pattern that downloads and runs second-stage malware.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange
Suspicious Script Host Spawning PowerShell Download Cradle (via process_creation)
Suspicious PowerShell Spawned by Windows Script Host during Scarlet Goldfinch Infection (via process_creation)
Suspicious Script Host Launching PowerShell from Fattura Named JScript File (via process_creation)
Suspicious Script Host Spawning PowerShell from Fake Browser Update JS
Suspicious Script Host Spawning PowerShell via Process Creation
Suspicious PowerShell Spawned by cscript in Script Chain
Malicious Emmenhtal JavaScript Loader Spawning Encoded PowerShell
Suspicious Script Execution from Public User Folder Staging Directory
Suspicious PowerShell Bypass Spawned by wscript Script Host
Suspicious Script Host Spawning PowerShell With Bypass And Hidden Execution
Pivot detection · T1059.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.