Windows Process Creation: Wscript.Shell.Run keyword sequence in CommandLine
Alerts on Windows command lines containing Wscript.Shell.Run keyword sequence, suggesting script-driven shell execution.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-08-31
- Updated
- 2026-07-30
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation events whose CommandLine contains a specific keyword sequence: "Wscript.", ".Shell", and ".Run". Attackers may use Windows Script Host (Wscript) to execute script-driven automation and invoke shell actions, which can align with suspicious launcher behavior. The detection relies on process creation telemetry and string matching within the CommandLine field.
Reporting behind it
- web.archive.orghttps://web.archive.org/web/20220830122045/http://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html
- blog.talosintelligence.comhttps://blog.talosintelligence.com/modernloader-delivers-multiple-stealers-cryptominers-and-rats/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mshta_inline_vbscript.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Wscript.Shell.Run keyword sequence in CommandLine"
id: 2cb8991f-8c98-4a15-8392-868ff76bc2f7
status: test
description: 'This rule flags Windows process creation events whose CommandLine contains a specific keyword sequence: "Wscript.", ".Shell", and ".Run". Attackers may use Windows Script Host (Wscript) to execute script-driven automation and invoke shell actions, which can align with suspicious launcher behavior. The detection relies on process creation telemetry and string matching within the CommandLine field.'
references:
- https://web.archive.org/web/20220830122045/http://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html
- https://blog.talosintelligence.com/modernloader-delivers-multiple-stealers-cryptominers-and-rats/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mshta_inline_vbscript.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-31
modified: 2023-05-15
tags:
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains|all:
- Wscript.
- .Shell
- .Run
condition: selection
falsepositives:
- Inline scripting can be used by some rare third party applications or administrators. Investigate and apply additional filters accordingly
level: medium
license: DRL-1.1
related:
- id: 2c28c248-7f50-417a-9186-a85b223010ee
type: derived