Windows Process Creation: cscript/wscript Running gatherNetworkInfo.vbs

Alerts on cscript/wscript processes running gatherNetworkInfo.vbs, indicating potential host/network reconnaissance.

FreeReviewedSigma · Medium · v2

Product: windows
Category: process_creation
Author: blueteamer8699 (SigmaHQ), DRL 1.1
Published: 2022-01-03
Updated: 2026-07-31

ATT&CK techniques

Execution → Discovery

Recon
Resource Dev
Initial Access
Execution
- T1059.005Visual Basic
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1615Group Policy Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies execution of the built-in gatherNetworkInfo.vbs script by matching process creation events for cscript.exe or wscript.exe with a command line containing gatherNetworkInfo.vbs. Attackers can use this script to quickly gather host and network information for reconnaissance. It relies on Windows process creation telemetry, including the process image name, original file name, and the full command line.

Reporting behind it

Related detections9 linkedT1059.005 — drag to rearrange

Suspicious Windows Process Execution of gatherNetworkInfo.vbs via Cscript/Wscript

Malicious mshta Launching WScript VBScript Loader

Suspicious wscript Execution Forcing VBScript Engine in Batch Mode

Suspicious Batch Script Execution Spawned by wscript via VBScript

Suspicious NW.js Runtime Execution from AppData Roaming by Charcoal Stork (via process_creation)

Suspicious WScript VBS Execution from Temp Directory in CVE-2023-36884 Exploit Chain

Suspicious VBScript Execution from ProgramLogs Directory via Windows Script Host

Malicious Script Execution via Cisco AnyConnect OnConnect Handler Abuse

Malicious rundll32 IternalJob Export Spawned by wscript (via process_creation)

Windows Process Creation: cscript/wscript Running gatherNetworkInfo.vbs

Pivot detection · T1059.005 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-detect-execution-of-gathernetworkinfo-vbs-via-cscript-exe-or-wscript-exe-575dce0c

title: "Windows Process Creation: cscript/wscript Running gatherNetworkInfo.vbs"
id: 100da002-0c17-4f3f-b93f-de996a73acea
related:
  - id: f92a6f1e-a512-4a15-9735-da09e78d7273
    type: similar
  - id: 07aa184a-870d-413d-893a-157f317f6f58
    type: similar
  - id: 575dce0c-8139-4e30-9295-1ee75969f7fe
    type: derived
status: test
description: This rule identifies execution of the built-in gatherNetworkInfo.vbs script by matching process creation events for cscript.exe or wscript.exe with a command line containing gatherNetworkInfo.vbs. Attackers can use this script to quickly gather host and network information for reconnaissance. It relies on Windows process creation telemetry, including the process image name, original file name, and the full command line.
references:
  - https://posts.slayerlabs.com/living-off-the-land/#gathernetworkinfovbs
  - https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_gather_network_info.yml
author: blueteamer8699, Huntrule Team
date: 2022-01-03
modified: 2023-02-08
tags:
  - attack.discovery
  - attack.execution
  - attack.t1615
  - attack.t1059.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \cscript.exe
        - \wscript.exe
    - OriginalFileName:
        - cscript.exe
        - wscript.exe
  selection_cli:
    CommandLine|contains: gatherNetworkInfo.vbs
  condition: all of selection_*
falsepositives:
  - Administrative activity
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL