Windows: Alert on csc.exe launched from suspicious script or PowerShell parents

title: "Windows: Alert on csc.exe launched from suspicious script or PowerShell parents"
id: bc606d11-2a1a-4275-81a9-f97fb99d2dc3
status: test
description: This rule flags process creation events where the executable ends with or is labeled as csc.exe, and the parent process is commonly used for script execution or document-driven execution (e.g., cscript, mshta, wscript, Office applications, onenote, outlook), or PowerShell with encoded command patterns. It matters because attackers may use these parent contexts to stage or deliver payloads that ultimately run csc.exe. The detection relies on Windows process creation telemetry, specifically the child Image/OriginalFileName and the parent Image and command line content/paths.
references:
  - https://www.uptycs.com/blog/warzonerat-can-now-evade-with-process-hollowing
  - https://reaqta.com/2017/11/short-journey-darkvnc/
  - https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_csc_susp_parent.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems), Huntrule Team
date: 2019-02-11
modified: 2026-03-23
tags:
  - attack.execution
  - attack.stealth
  - attack.t1059.005
  - attack.t1059.007
  - attack.t1218.005
  - attack.t1027.004
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \csc.exe
    - OriginalFileName: csc.exe
  selection_parent_generic:
    ParentImage|endswith:
      - \cscript.exe
      - \excel.exe
      - \mshta.exe
      - \onenote.exe
      - \outlook.exe
      - \powerpnt.exe
      - \winword.exe
      - \wscript.exe
  selection_parent_powershell:
    ParentImage|endswith:
      - \powershell.exe
      - \pwsh.exe
    ParentCommandLine|contains:
      - "-Encoded "
      - FromBase64String
  selection_parent_susp_location:
    - ParentCommandLine|re: (?:[Pp]rogram[Dd]ata|%(?:[Ll]ocal)?[Aa]pp[Dd]ata%|\\[Aa]pp[Dd]ata\\(?:[Ll]ocal(?:[Ll]ow)?|[Rr]oaming))\\[^\\]{1,256}$
    - ParentCommandLine|contains:
        - :\PerfLogs\
        - :\Users\Public\
        - :\Windows\Temp\
        - \Temporary Internet
    - ParentCommandLine|contains|all:
        - :\Users\
        - \Favorites\
    - ParentCommandLine|contains|all:
        - :\Users\
        - \Favourites\
    - ParentCommandLine|contains|all:
        - :\Users\
        - \Contacts\
    - ParentCommandLine|contains|all:
        - :\Users\
        - \Pictures\
  filter_main_programfiles:
    ParentImage|startswith:
      - C:\Program Files (x86)\
      - C:\Program Files\
  filter_main_sdiagnhost:
    ParentImage: C:\Windows\System32\sdiagnhost.exe
  filter_main_w3p:
    ParentImage: C:\Windows\System32\inetsrv\w3wp.exe
  filter_optional_chocolatey:
    ParentImage: C:\ProgramData\chocolatey\choco.exe
  filter_optional_defender:
    ParentCommandLine|contains: \ProgramData\Microsoft\Windows Defender Advanced Threat Protection
  filter_optional_ansible:
    ParentCommandLine|contains:
      - JwB7ACIAZgBhAGkAbABlAGQAIgA6AHQAcgB1AGUALAAiAG0AcwBnACIAOgAiAEEAbgBzAGkAYgBsAGUAIAByAGUAcQB1AGkAcgBlAHMAIABQAG8AdwBlAHIAUwBoAGUAbABsACAAdgAzAC4AMAAgAG8AcgAgAG4AZQB3AGUAcgAiAH0AJw
      - cAewAiAGYAYQBpAGwAZQBkACIAOgB0AHIAdQBlACwAIgBtAHMAZwAiADoAIgBBAG4AcwBpAGIAbABlACAAcgBlAHEAdQBpAHIAZQBzACAAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAMwAuADAAIABvAHIAIABuAGUAdwBlAHIAIgB9ACcA
      - nAHsAIgBmAGEAaQBsAGUAZAAiADoAdAByAHUAZQAsACIAbQBzAGcAIgA6ACIAQQBuAHMAaQBiAGwAZQAgAHIAZQBxAHUAaQByAGUAcwAgAFAAbwB3AGUAcgBTAGgAZQBsAGwAIAB2ADMALgAwACAAbwByACAAbgBlAHcAZQByACIAfQAnA
  condition: selection_img and 1 of selection_parent_* and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: b730a276-6b63-41b8-bcf8-55930c8fc6ee
    type: derived