Windows: Alert on suspicious parent process spawning csc.exe

Flags csc.exe execution when spawned by script/document hosts or PowerShell using encoded content, excluding common benign parent contexts.

FreeReviewedSigma · High · v2

Product: windows
Category: process_creation
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2019-02-11
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1059.005Visual Basic
- T1059.007JavaScript
Persistence
Priv Esc
Defense Evasion
- T1027.004Compile After Delivery
- T1218.005Mshta
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creation events where csc.exe is executed with a parent image that matches common scripting or automation binaries (e.g., cscript.exe, mshta.exe, wscript.exe, Office apps) or PowerShell launch patterns with encoded content. It matters because attackers may use csc.exe as a payload delivery or execution component when invoked from unusual parent processes or obfuscated command lines. The detection relies on Windows process creation telemetry, using parent process image/command-line fields and the executed image/original file name to match csc.exe.

Reporting behind it

Related detections9 linkedT1059.005 — drag to rearrange

Windows Remote Thread Creation via CACTUSTORCH Using Script/Office/Rundll Host Images

Suspicious Script Host Execution of Decoy-Named JavaScript Dropper (PS1Bot)

Suspicious MSHTA VBScript WScript Shell Execution

Suspicious Wscript Execution of JavaScript From AppData Local Temp via Process Creation (via process_creation)

Windows AppLocker Audit-Mode Events Indicate Files Would Have Been Blocked

Windows Wscript/Cscript Executes Files with Uncommon Non-Script Extensions

Windows WScript/CScript File Write With Script Extensions to Temp or Startup Paths

Windows AppLocker Blocked Application, Script, MSI, or Packaged-App Execution

Windows Process Creation: Suspicious Children Spawned by HTML Help (hh.exe)

Windows: Alert on suspicious parent process spawning csc.exe

Pivot detection · T1059.005 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-alert-on-csc-exe-launched-from-suspicious-script-or-powershell-parents-b730a276

title: "Windows: Alert on suspicious parent process spawning csc.exe"
id: bc606d11-2a1a-4275-81a9-f97fb99d2dc3
status: test
description: This rule flags process creation events where csc.exe is executed with a parent image that matches common scripting or automation binaries (e.g., cscript.exe, mshta.exe, wscript.exe, Office apps) or PowerShell launch patterns with encoded content. It matters because attackers may use csc.exe as a payload delivery or execution component when invoked from unusual parent processes or obfuscated command lines. The detection relies on Windows process creation telemetry, using parent process image/command-line fields and the executed image/original file name to match csc.exe.
references:
  - https://www.uptycs.com/blog/warzonerat-can-now-evade-with-process-hollowing
  - https://reaqta.com/2017/11/short-journey-darkvnc/
  - https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_csc_susp_parent.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems), Huntrule Team
date: 2019-02-11
modified: 2026-03-23
tags:
  - attack.execution
  - attack.stealth
  - attack.t1059.005
  - attack.t1059.007
  - attack.t1218.005
  - attack.t1027.004
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \csc.exe
    - OriginalFileName: csc.exe
  selection_parent_generic:
    ParentImage|endswith:
      - \cscript.exe
      - \excel.exe
      - \mshta.exe
      - \onenote.exe
      - \outlook.exe
      - \powerpnt.exe
      - \winword.exe
      - \wscript.exe
  selection_parent_powershell:
    ParentImage|endswith:
      - \powershell.exe
      - \pwsh.exe
    ParentCommandLine|contains:
      - "-Encoded "
      - FromBase64String
  selection_parent_susp_location:
    - ParentCommandLine|re: (?:[Pp]rogram[Dd]ata|%(?:[Ll]ocal)?[Aa]pp[Dd]ata%|\\[Aa]pp[Dd]ata\\(?:[Ll]ocal(?:[Ll]ow)?|[Rr]oaming))\\[^\\]{1,256}$
    - ParentCommandLine|contains:
        - :\PerfLogs\
        - :\Users\Public\
        - :\Windows\Temp\
        - \Temporary Internet
    - ParentCommandLine|contains|all:
        - :\Users\
        - \Favorites\
    - ParentCommandLine|contains|all:
        - :\Users\
        - \Favourites\
    - ParentCommandLine|contains|all:
        - :\Users\
        - \Contacts\
    - ParentCommandLine|contains|all:
        - :\Users\
        - \Pictures\
  filter_main_programfiles:
    ParentImage|startswith:
      - C:\Program Files (x86)\
      - C:\Program Files\
  filter_main_sdiagnhost:
    ParentImage: C:\Windows\System32\sdiagnhost.exe
  filter_main_w3p:
    ParentImage: C:\Windows\System32\inetsrv\w3wp.exe
  filter_optional_chocolatey:
    ParentImage: C:\ProgramData\chocolatey\choco.exe
  filter_optional_defender:
    ParentCommandLine|contains: \ProgramData\Microsoft\Windows Defender Advanced Threat Protection
  filter_optional_ansible:
    ParentCommandLine|contains:
      - JwB7ACIAZgBhAGkAbABlAGQAIgA6AHQAcgB1AGUALAAiAG0AcwBnACIAOgAiAEEAbgBzAGkAYgBsAGUAIAByAGUAcQB1AGkAcgBlAHMAIABQAG8AdwBlAHIAUwBoAGUAbABsACAAdgAzAC4AMAAgAG8AcgAgAG4AZQB3AGUAcgAiAH0AJw
      - cAewAiAGYAYQBpAGwAZQBkACIAOgB0AHIAdQBlACwAIgBtAHMAZwAiADoAIgBBAG4AcwBpAGIAbABlACAAcgBlAHEAdQBpAHIAZQBzACAAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAMwAuADAAIABvAHIAIABuAGUAdwBlAHIAIgB9ACcA
      - nAHsAIgBmAGEAaQBsAGUAZAAiADoAdAByAHUAZQAsACIAbQBzAGcAIgA6ACIAQQBuAHMAaQBiAGwAZQAgAHIAZQBxAHUAaQByAGUAcwAgAFAAbwB3AGUAcgBTAGgAZQBsAGwAIAB2ADMALgAwACAAbwByACAAbgBlAHcAZQByACIAfQAnA
  condition: selection_img and 1 of selection_parent_* and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: b730a276-6b63-41b8-bcf8-55930c8fc6ee
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL