huntrule

Suspicious Windows Process Execution of gatherNetworkInfo.vbs via Cscript/Wscript

Alerts on Windows executions referencing gatherNetworkInfo.vbs in process command lines, indicative of potential discovery activity.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2023-02-08
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Execution → Discovery

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process creation where the command line contains the built-in script path component "gatherNetworkInfo.vbs". Attackers may use this script to collect host/network information during reconnaissance. It relies on Windows process creation telemetry, correlating command-line content with the script identifier while excluding cases where cscript.exe or wscript.exe are the parent image.

Reporting behind it

Related detections9 linkedT1059.005 — drag to rearrange
Windows Process Creation: cscript/wscript Running gatherNetworkInfo.vbs
Malicious mshta Launching WScript VBScript Loader
Suspicious wscript Execution Forcing VBScript Engine in Batch Mode
Suspicious Batch Script Execution Spawned by wscript via VBScript
Suspicious NW.js Runtime Execution from AppData Roaming by Charcoal Stork (via process_creation)
Suspicious WScript VBS Execution from Temp Directory in CVE-2023-36884 Exploit Chain
Suspicious VBScript Execution from ProgramLogs Directory via Windows Script Host
Malicious Script Execution via Cisco AnyConnect OnConnect Handler Abuse
Malicious rundll32 IternalJob Export Spawned by wscript (via process_creation)
Suspicious Windows Process Execution of gatherNetworkInfo.vbs via Cscript/Wscript
Pivot detection · T1059.005 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.