Windows manage-bde.wsf via wscript/cscript Proxy Execution
Flags Windows process executions where wscript/cscript runs manage-bde.wsf, indicating potential proxy execution via LOLBIN.
- Product
- windows
- Category
- process_creation
- Author
- oscd.community, Natalia Shornikova, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2020-10-13
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation where WScript (wscript.exe) is invoked with command lines containing manage-bde.wsf, or where the parent process is cscript.exe/wscript.exe running manage-bde.wsf and the child is not cmd.exe. Attackers can use this signed script host pathway to proxy execution and launch further activity through trusted Microsoft tooling. Telemetry required includes process creation events with Image, OriginalFileName, ParentImage, ParentCommandLine, and CommandLine fields.
Reporting behind it
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/Scripts/Manage-bde/
- gist.github.comhttps://gist.github.com/bohops/735edb7494fe1bd1010d67823842b712
- twitter.comhttps://twitter.com/bohops/status/980659399495741441
- twitter.comhttps://twitter.com/JohnLaTwC/status/1223292479270600706
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1216/T1216.md
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_manage_bde.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows manage-bde.wsf via wscript/cscript Proxy Execution
id: 6c7ed818-1076-4f89-8946-7e4ec57ee97c
status: test
description: This rule flags Windows process creation where WScript (wscript.exe) is invoked with command lines containing manage-bde.wsf, or where the parent process is cscript.exe/wscript.exe running manage-bde.wsf and the child is not cmd.exe. Attackers can use this signed script host pathway to proxy execution and launch further activity through trusted Microsoft tooling. Telemetry required includes process creation events with Image, OriginalFileName, ParentImage, ParentCommandLine, and CommandLine fields.
references:
- https://lolbas-project.github.io/lolbas/Scripts/Manage-bde/
- https://gist.github.com/bohops/735edb7494fe1bd1010d67823842b712
- https://twitter.com/bohops/status/980659399495741441
- https://twitter.com/JohnLaTwC/status/1223292479270600706
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1216/T1216.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_manage_bde.yml
author: oscd.community, Natalia Shornikova, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2020-10-13
modified: 2023-02-03
tags:
- attack.stealth
- attack.t1216
logsource:
category: process_creation
product: windows
detection:
selection_wscript_img:
- Image|endswith: \wscript.exe
- OriginalFileName: wscript.exe
selection_wscript_cli:
CommandLine|contains: manage-bde.wsf
selection_parent:
ParentImage|endswith:
- \cscript.exe
- \wscript.exe
ParentCommandLine|contains: manage-bde.wsf
selection_filter_cmd:
Image|endswith: \cmd.exe
condition: all of selection_wscript_* or (selection_parent and not selection_filter_cmd)
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: c363385c-f75d-4753-a108-c1a8e28bdbda
type: derived