huntrule

Suspicious Windows Process Execution of gatherNetworkInfo.vbs via Cscript/Wscript

Alerts on Windows executions referencing gatherNetworkInfo.vbs in process command lines, indicative of potential discovery activity.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2023-02-08
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Execution → Discovery

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process creation where the command line contains the built-in script path component "gatherNetworkInfo.vbs". Attackers may use this script to collect host/network information during reconnaissance. It relies on Windows process creation telemetry, correlating command-line content with the script identifier while excluding cases where cscript.exe or wscript.exe are the parent image.

Reporting behind it

Related detections9 linkedT1059.005 — drag to rearrange
Windows Process Creation: cscript/wscript Running gatherNetworkInfo.vbs
Suspicious Script Host Execution of Decoy-Named JavaScript Dropper (PS1Bot)
Malicious PathWiper Loader Script Execution from Windows Temp via WScript
Suspicious Office Application Spawning Script Or Shell Interpreter
Malicious Script Host Spawning PowerShell With Invoke-Expression (via process_creation)
Suspicious MSHTA VBScript WScript Shell Execution
Malicious Kimsuky VBE Payload Download via Curl to AppData and Execution (via process_creation)
Suspicious winrm.vbs LOLBAS Script Execution for Code Proxying
Malicious LitterDrifter VBScript Execution via wscript trash.dll
Suspicious Windows Process Execution of gatherNetworkInfo.vbs via Cscript/Wscript
Pivot detection · T1059.005 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.