Windows Process Creation: cscript/wscript Running gatherNetworkInfo.vbs

Alerts on cscript/wscript processes running gatherNetworkInfo.vbs, indicating potential host/network reconnaissance.

FreeReviewedSigma · Medium · v2

Product: windows
Category: process_creation
Author: blueteamer8699 (SigmaHQ), DRL 1.1
Published: 2022-01-03
Updated: 2026-07-31

ATT&CK techniques

Execution → Discovery

Recon
Resource Dev
Initial Access
Execution
- T1059.005Visual Basic
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1615Group Policy Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies execution of the built-in gatherNetworkInfo.vbs script by matching process creation events for cscript.exe or wscript.exe with a command line containing gatherNetworkInfo.vbs. Attackers can use this script to quickly gather host and network information for reconnaissance. It relies on Windows process creation telemetry, including the process image name, original file name, and the full command line.

Reporting behind it

Related detections9 linkedT1059.005 — drag to rearrange

Suspicious Windows Process Execution of gatherNetworkInfo.vbs via Cscript/Wscript

Suspicious Script Host Execution of Decoy-Named JavaScript Dropper (PS1Bot)

Malicious PathWiper Loader Script Execution from Windows Temp via WScript

Suspicious Office Application Spawning Script Or Shell Interpreter

Malicious Script Host Spawning PowerShell With Invoke-Expression (via process_creation)

Suspicious MSHTA VBScript WScript Shell Execution

Malicious Kimsuky VBE Payload Download via Curl to AppData and Execution (via process_creation)

Suspicious winrm.vbs LOLBAS Script Execution for Code Proxying

Malicious LitterDrifter VBScript Execution via wscript trash.dll

Windows Process Creation: cscript/wscript Running gatherNetworkInfo.vbs

Pivot detection · T1059.005 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-detect-execution-of-gathernetworkinfo-vbs-via-cscript-exe-or-wscript-exe-575dce0c

title: "Windows Process Creation: cscript/wscript Running gatherNetworkInfo.vbs"
id: 100da002-0c17-4f3f-b93f-de996a73acea
related:
  - id: f92a6f1e-a512-4a15-9735-da09e78d7273
    type: similar
  - id: 07aa184a-870d-413d-893a-157f317f6f58
    type: similar
  - id: 575dce0c-8139-4e30-9295-1ee75969f7fe
    type: derived
status: test
description: This rule identifies execution of the built-in gatherNetworkInfo.vbs script by matching process creation events for cscript.exe or wscript.exe with a command line containing gatherNetworkInfo.vbs. Attackers can use this script to quickly gather host and network information for reconnaissance. It relies on Windows process creation telemetry, including the process image name, original file name, and the full command line.
references:
  - https://posts.slayerlabs.com/living-off-the-land/#gathernetworkinfovbs
  - https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_gather_network_info.yml
author: blueteamer8699, Huntrule Team
date: 2022-01-03
modified: 2023-02-08
tags:
  - attack.discovery
  - attack.execution
  - attack.t1615
  - attack.t1059.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \cscript.exe
        - \wscript.exe
    - OriginalFileName:
        - cscript.exe
        - wscript.exe
  selection_cli:
    CommandLine|contains: gatherNetworkInfo.vbs
  condition: all of selection_*
falsepositives:
  - Administrative activity
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL