Windows Process Execution Matches Griffon Malicious Command-Line Pattern
Alerts on Windows process command lines containing a temp staging path plus jscript execution indicators and a .txt target.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-03-09
- Updated
- 2026-07-31
What it detects
This rule flags Windows process creation events whose command line contains a specific set of substrings consistent with a Griffon-related malware execution pattern: a local temp path, a command-line directive to run jscript via //b /e:jscript, and a .txt file reference. Such scripted execution from temporary locations is commonly used by attackers to stage and run payloads with minimal artifacts. The detection relies on process creation telemetry, specifically the full command line string.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Process Execution Matches Griffon Malicious Command-Line Pattern
id: 4e730ae8-a5c5-491e-86d0-a8e6b65af924
status: test
description: "This rule flags Windows process creation events whose command line contains a specific set of substrings consistent with a Griffon-related malware execution pattern: a local temp path, a command-line directive to run jscript via //b /e:jscript, and a .txt file reference. Such scripted execution from temporary locations is commonly used by attackers to stage and run payloads with minimal artifacts. The detection relies on process creation telemetry, specifically the full command line string."
references:
- https://securelist.com/fin7-5-the-infamous-cybercrime-rig-fin7-continues-its-activities/90703/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/Griffon/proc_creation_win_malware_griffon_patterns.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-03-09
tags:
- attack.execution
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains|all:
- \local\temp\
- //b /e:jscript
- .txt
condition: selection
falsepositives:
- Unlikely
level: critical
license: DRL-1.1
related:
- id: bcc6f179-11cd-4111-a9a6-0fab68515cf7
type: derived