Windows process creation: wtaks.exe/ winwsh.exe parameters resembling Mustang Panda dropper behavior

title: "Windows process creation: wtaks.exe/ winwsh.exe parameters resembling Mustang Panda dropper behavior"
id: 089fd9de-ec27-4e59-8f8b-688ce50ade28
status: test
description: This rule flags Windows process creation events where the command line includes specific parameters used to spawn a temporary task executable and run a script-based payload via console options (including VBS execution and text-file paths). It also matches execution of an image named winwsh.exe from a temporary directory. These patterns matter because dropper-like activity often stages binaries in writable temp locations and launches script execution to deploy or persist malicious components. The detection relies on telemetry that records process command lines and process image paths on Windows.
references:
  - https://app.any.run/tasks/7ca5661d-a67b-43ec-98c1-dd7a8103c256/
  - https://app.any.run/tasks/b12cccf3-1c22-4e28-9d3e-c7a6062f3914/
  - https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/TA/MustangPanda/proc_creation_win_apt_mustangpanda.yml
author: Florian Roth (Nextron Systems), oscd.community, Huntrule Team
date: 2019-10-30
modified: 2021-11-27
tags:
  - attack.t1587.001
  - attack.resource-development
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_cli:
    - CommandLine|contains:
        - Temp\wtask.exe /create
        - "%windir:~-3,1%%PUBLIC:~-9,1%"
        - '/tn "Security Script '
        - "%windir:~-1,1%"
    - CommandLine|contains|all:
        - /E:vbscript
        - C:\Users\
        - .txt
        - /F
  selection_img:
    Image|endswith: Temp\winwsh.exe
  condition: 1 of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 2d87d610-d760-45ee-a7e6-7a6f2a65de00
    type: derived