Windows: Alert on suspicious parent process spawning csc.exe
Flags csc.exe execution when spawned by script/document hosts or PowerShell using encoded content, excluding common benign parent contexts.
FreeReviewedSigma · High · v2
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2019-02-11
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation events where csc.exe is executed with a parent image that matches common scripting or automation binaries (e.g., cscript.exe, mshta.exe, wscript.exe, Office apps) or PowerShell launch patterns with encoded content. It matters because attackers may use csc.exe as a payload delivery or execution component when invoked from unusual parent processes or obfuscated command lines. The detection relies on Windows process creation telemetry, using parent process image/command-line fields and the executed image/original file name to match csc.exe.
Reporting behind it
- uptycs.comhttps://www.uptycs.com/blog/warzonerat-can-now-evade-with-process-hollowing
- reaqta.comhttps://reaqta.com/2017/11/short-journey-darkvnc/
- pwc.comhttps://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_csc_susp_parent.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-alert-on-csc-exe-launched-from-suspicious-script-or-powershell-parents-b730a276
title: "Windows: Alert on suspicious parent process spawning csc.exe"
id: bc606d11-2a1a-4275-81a9-f97fb99d2dc3
status: test
description: This rule flags process creation events where csc.exe is executed with a parent image that matches common scripting or automation binaries (e.g., cscript.exe, mshta.exe, wscript.exe, Office apps) or PowerShell launch patterns with encoded content. It matters because attackers may use csc.exe as a payload delivery or execution component when invoked from unusual parent processes or obfuscated command lines. The detection relies on Windows process creation telemetry, using parent process image/command-line fields and the executed image/original file name to match csc.exe.
references:
- https://www.uptycs.com/blog/warzonerat-can-now-evade-with-process-hollowing
- https://reaqta.com/2017/11/short-journey-darkvnc/
- https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_csc_susp_parent.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems), Huntrule Team
date: 2019-02-11
modified: 2026-03-23
tags:
- attack.execution
- attack.stealth
- attack.t1059.005
- attack.t1059.007
- attack.t1218.005
- attack.t1027.004
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \csc.exe
- OriginalFileName: csc.exe
selection_parent_generic:
ParentImage|endswith:
- \cscript.exe
- \excel.exe
- \mshta.exe
- \onenote.exe
- \outlook.exe
- \powerpnt.exe
- \winword.exe
- \wscript.exe
selection_parent_powershell:
ParentImage|endswith:
- \powershell.exe
- \pwsh.exe
ParentCommandLine|contains:
- "-Encoded "
- FromBase64String
selection_parent_susp_location:
- ParentCommandLine|re: (?:[Pp]rogram[Dd]ata|%(?:[Ll]ocal)?[Aa]pp[Dd]ata%|\\[Aa]pp[Dd]ata\\(?:[Ll]ocal(?:[Ll]ow)?|[Rr]oaming))\\[^\\]{1,256}$
- ParentCommandLine|contains:
- :\PerfLogs\
- :\Users\Public\
- :\Windows\Temp\
- \Temporary Internet
- ParentCommandLine|contains|all:
- :\Users\
- \Favorites\
- ParentCommandLine|contains|all:
- :\Users\
- \Favourites\
- ParentCommandLine|contains|all:
- :\Users\
- \Contacts\
- ParentCommandLine|contains|all:
- :\Users\
- \Pictures\
filter_main_programfiles:
ParentImage|startswith:
- C:\Program Files (x86)\
- C:\Program Files\
filter_main_sdiagnhost:
ParentImage: C:\Windows\System32\sdiagnhost.exe
filter_main_w3p:
ParentImage: C:\Windows\System32\inetsrv\w3wp.exe
filter_optional_chocolatey:
ParentImage: C:\ProgramData\chocolatey\choco.exe
filter_optional_defender:
ParentCommandLine|contains: \ProgramData\Microsoft\Windows Defender Advanced Threat Protection
filter_optional_ansible:
ParentCommandLine|contains:
- JwB7ACIAZgBhAGkAbABlAGQAIgA6AHQAcgB1AGUALAAiAG0AcwBnACIAOgAiAEEAbgBzAGkAYgBsAGUAIAByAGUAcQB1AGkAcgBlAHMAIABQAG8AdwBlAHIAUwBoAGUAbABsACAAdgAzAC4AMAAgAG8AcgAgAG4AZQB3AGUAcgAiAH0AJw
- cAewAiAGYAYQBpAGwAZQBkACIAOgB0AHIAdQBlACwAIgBtAHMAZwAiADoAIgBBAG4AcwBpAGIAbABlACAAcgBlAHEAdQBpAHIAZQBzACAAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAMwAuADAAIABvAHIAIABuAGUAdwBlAHIAIgB9ACcA
- nAHsAIgBmAGEAaQBsAGUAZAAiADoAdAByAHUAZQAsACIAbQBzAGcAIgA6ACIAQQBuAHMAaQBiAGwAZQAgAHIAZQBxAHUAaQByAGUAcwAgAFAAbwB3AGUAcgBTAGgAZQBsAGwAIAB2ADMALgAwACAAbwByACAAbgBlAHcAZQByACIAfQAnA
condition: selection_img and 1 of selection_parent_* and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: b730a276-6b63-41b8-bcf8-55930c8fc6ee
type: derived