Windows Process Execution Indicating CScript VBScript and csvde Web Shell Dropping

title: Windows Process Execution Indicating CScript VBScript and csvde Web Shell Dropping
id: 0eefeec6-3e4f-464a-87cc-93a0f37f8409
status: test
description: This rule flags Windows process creation where cscript.exe is invoked with a VBScript shell pattern and where csvde is executed with arguments consistent with writing log output under the Windows web directory. The behavior matters because abusing built-in scripting and directory export utilities can support initial execution and web-accessible payload staging. Telemetry relies on process creation events including the image path and full command line.
references:
  - https://web.archive.org/web/20180725233601/https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2017/TA/APT10/proc_creation_win_apt_apt10_cloud_hopper.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-04-07
modified: 2023-03-08
tags:
  - attack.execution
  - attack.g0045
  - attack.t1059.005
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_cscript:
    Image|endswith: \cscript.exe
    CommandLine|contains: ".vbs /shell "
  selection_csvde:
    CommandLine|contains|all:
      - csvde -f C:\windows\web\
      - .log
  condition: 1 of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 966e4016-627f-44f7-8341-f394905c361f
    type: derived