Windows Process Creation: Suspicious JScript Execution via Temp Errors.bat

title: "Windows Process Creation: Suspicious JScript Execution via Temp Errors.bat"
id: 80e39858-55bb-4886-8046-dd93f9058957
status: test
description: This rule flags Windows process creation events where the command line contains both the JScript execution switch (/e:jscript) and a batch script path under \Local\Temp\Errors.bat. Attackers can use scripted execution from temporary locations to run code with minimal artifacts and to stage follow-on actions. The detection relies on process creation telemetry with full command-line visibility, matching the two required substrings.
references:
  - https://securelist.com/fin7-5-the-infamous-cybercrime-rig-fin7-continues-its-activities/90703/
  - https://malpedia.caad.fkie.fraunhofer.de/actor/anthropoid_spider
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/TA/EmpireMonkey/proc_creation_win_apt_empiremonkey.yml
author: Markus Neis, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2019-04-02
modified: 2023-03-09
tags:
  - attack.stealth
  - attack.t1218.010
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - /e:jscript
      - \Local\Temp\Errors.bat
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 10152a7b-b566-438f-a33c-390b607d1c8d
    type: derived