Windows Process Creation: cscript/wscript Register-App.vbs COM+ Registration

Alert on cscript/wscript running “.vbs -register” to register COM+ components, potentially leveraging register_app.vbs.

FreeUnreviewedSigmamediumv1

windows-process-creation-cscript-wscript-register-app-vbs-com-registration-28c8f68b

title: "Windows Process Creation: cscript/wscript Register-App.vbs COM+ Registration"
id: 5bace648-a57a-4cfd-bdef-8e2b8dd27214
status: test
description: This rule flags executions of cscript.exe or wscript.exe running a VBS file with the command-line pattern “.vbs -register”. It targets attempts to register COM+ providers via register_app.vbs, which can enable attackers to set up malicious component loading for persistence or execution. The detection relies on Windows process creation telemetry, specifically the process image name and command-line content.
references:
  - https://twitter.com/sblmsrsn/status/1456613494783160325?s=20
  - https://github.com/microsoft/Windows-classic-samples/blob/7cbd99ac1d2b4a0beffbaba29ea63d024ceff700/Samples/Win7Samples/winbase/vss/vsssampleprovider/register_app.vbs
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolscript_register_app.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-11-05
modified: 2022-07-07
tags:
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \cscript.exe
        - \wscript.exe
    - OriginalFileName:
        - cscript.exe
        - wscript.exe
  selection_cli:
    CommandLine|contains: ".vbs -register "
  condition: all of selection*
falsepositives:
  - Other VB scripts that leverage the same starting command line flags
level: medium
license: DRL-1.1
related:
  - id: 28c8f68b-098d-45af-8d43-8089f3e35403
    type: derived

What it detects

This rule flags executions of cscript.exe or wscript.exe running a VBS file with the command-line pattern “.vbs -register”. It targets attempts to register COM+ providers via register_app.vbs, which can enable attackers to set up malicious component loading for persistence or execution. The detection relies on Windows process creation telemetry, specifically the process image name and command-line content.

Known false positives

Other VB scripts that leverage the same starting command line flags

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.