Windows: Detect execution of gatherNetworkInfo.vbs via cscript.exe or wscript.exe

title: "Windows: Detect execution of gatherNetworkInfo.vbs via cscript.exe or wscript.exe"
id: 100da002-0c17-4f3f-b93f-de996a73acea
related:
  - id: f92a6f1e-a512-4a15-9735-da09e78d7273
    type: similar
  - id: 07aa184a-870d-413d-893a-157f317f6f58
    type: similar
  - id: 575dce0c-8139-4e30-9295-1ee75969f7fe
    type: derived
status: test
description: This rule flags process creation on Windows where cscript.exe or wscript.exe executes a script containing gatherNetworkInfo.vbs. gatherNetworkInfo.vbs can be used to collect network and host information during reconnaissance, which may help an attacker plan further activity. Telemetry required is Windows process creation data, including the image (script host) and command-line contents identifying gatherNetworkInfo.vbs.
references:
  - https://posts.slayerlabs.com/living-off-the-land/#gathernetworkinfovbs
  - https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_gather_network_info.yml
author: blueteamer8699, Huntrule Team
date: 2022-01-03
modified: 2023-02-08
tags:
  - attack.discovery
  - attack.execution
  - attack.t1615
  - attack.t1059.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \cscript.exe
        - \wscript.exe
    - OriginalFileName:
        - cscript.exe
        - wscript.exe
  selection_cli:
    CommandLine|contains: gatherNetworkInfo.vbs
  condition: all of selection_*
falsepositives:
  - Administrative activity
level: medium
license: DRL-1.1