Windows Process Creation: Suspicious Inline VBScript (UNC2452 UN2452 Pattern)

title: "Windows Process Creation: Suspicious Inline VBScript (UNC2452 UN2452 Pattern)"
id: 09adc80c-62b3-4dbc-962b-5264d9a5b7e8
status: test
description: This rule flags Windows process creation events whose command line contains multiple inline VBScript keywords commonly associated with the UNC2452 UN2452 pattern, including COM object creation and registry read activity. Attackers use these scripting constructs to automate execution and potentially establish persistence or collect information via targeted registry access. It relies on command-line telemetry from process creation, matching for specific VBScript tokens and excluding cases that include the Run key path.
references:
  - https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/TA/SolarWinds-Supply-Chain/proc_creation_win_apt_unc2452_vbscript_pattern.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-03-05
modified: 2022-10-09
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1547.001
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - Execute
      - CreateObject
      - RegRead
      - window.close
      - \Microsoft\Windows\CurrentVersion
  filter:
    CommandLine|contains: \Software\Microsoft\Windows\CurrentVersion\Run
  condition: selection and not filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 20c3f09d-c53d-4e85-8b74-6aa50e2f1b61
    type: derived