Windows Process Creation: Wscript.Shell.Run keyword sequence in CommandLine

Alerts on Windows command lines containing Wscript.Shell.Run keyword sequence, suggesting script-driven shell execution.

FreeUnreviewedSigmamediumv1

windows-process-creation-wscript-shell-run-keyword-sequence-in-commandline-2c28c248

title: "Windows Process Creation: Wscript.Shell.Run keyword sequence in CommandLine"
id: 2cb8991f-8c98-4a15-8392-868ff76bc2f7
status: test
description: 'This rule flags Windows process creation events whose CommandLine contains a specific keyword sequence: "Wscript.", ".Shell", and ".Run". Attackers may use Windows Script Host (Wscript) to execute script-driven automation and invoke shell actions, which can align with suspicious launcher behavior. The detection relies on process creation telemetry and string matching within the CommandLine field.'
references:
  - https://web.archive.org/web/20220830122045/http://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html
  - https://blog.talosintelligence.com/modernloader-delivers-multiple-stealers-cryptominers-and-rats/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mshta_inline_vbscript.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-31
modified: 2023-05-15
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - Wscript.
      - .Shell
      - .Run
  condition: selection
falsepositives:
  - Inline scripting can be used by some rare third party applications or administrators. Investigate and apply additional filters accordingly
level: medium
license: DRL-1.1
related:
  - id: 2c28c248-7f50-417a-9186-a85b223010ee
    type: derived

What it detects

This rule flags Windows process creation events whose CommandLine contains a specific keyword sequence: "Wscript.", ".Shell", and ".Run". Attackers may use Windows Script Host (Wscript) to execute script-driven automation and invoke shell actions, which can align with suspicious launcher behavior. The detection relies on process creation telemetry and string matching within the CommandLine field.

Known false positives

Inline scripting can be used by some rare third party applications or administrators. Investigate and apply additional filters accordingly

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.