Windows: manage-bde.wsf Executed via wscript/cscript to Proxy Command Execution

title: "Windows: manage-bde.wsf Executed via wscript/cscript to Proxy Command Execution"
id: 6c7ed818-1076-4f89-8946-7e4ec57ee97c
status: test
description: This rule identifies process creation events where wscript.exe is invoked with a command line containing manage-bde.wsf, or where cscript.exe/wscript.exe are the parent processes running manage-bde.wsf. Attackers may use this scripting entry point as a proxy to launch or stage execution under a trusted Windows component. It relies on process creation telemetry, specifically Image/OriginalFileName fields and command-line and parent command-line content matching manage-bde.wsf.
references:
  - https://lolbas-project.github.io/lolbas/Scripts/Manage-bde/
  - https://gist.github.com/bohops/735edb7494fe1bd1010d67823842b712
  - https://twitter.com/bohops/status/980659399495741441
  - https://twitter.com/JohnLaTwC/status/1223292479270600706
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1216/T1216.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_manage_bde.yml
author: oscd.community, Natalia Shornikova, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2020-10-13
modified: 2023-02-03
tags:
  - attack.stealth
  - attack.t1216
logsource:
  category: process_creation
  product: windows
detection:
  selection_wscript_img:
    - Image|endswith: \wscript.exe
    - OriginalFileName: wscript.exe
  selection_wscript_cli:
    CommandLine|contains: manage-bde.wsf
  selection_parent:
    ParentImage|endswith:
      - \cscript.exe
      - \wscript.exe
    ParentCommandLine|contains: manage-bde.wsf
  selection_filter_cmd:
    Image|endswith: \cmd.exe
  condition: all of selection_wscript_* or (selection_parent and not selection_filter_cmd)
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: c363385c-f75d-4753-a108-c1a8e28bdbda
    type: derived