huntrule

Windows Process Recon via Wscript/Cmd Redirection to %APPDATA% (Devil Bait)

Flags cmd.exe launched by wscript.exe to redirect discovery output into %APPDATA%\Microsoft (.xml/.txt) using system enumeration commands.

FreeUnreviewedSigmahighv1
title: Windows Process Recon via Wscript/Cmd Redirection to %APPDATA% (Devil Bait)
id: a3807b67-603a-456c-848d-521ed56c16b1
related:
  - id: 8e0bb260-d4b2-4fff-bb8d-3f82118e6892
    type: derived
  - id: e8954be4-b2b8-4961-be18-da1a5bda709c
    type: derived
status: test
description: This rule identifies Windows process activity where wscript.exe spawns cmd.exe that redirects output to a path under %APPDATA%\Microsoft, writing .xml or .txt files. It further matches command-line reconnaissance behavior commonly used for local system discovery, including ipconfig /all plus commands such as dir, systeminfo, and tasklist. Attackers rely on this staged discovery to profile the host and prepare for follow-on intrusion. Telemetry required includes process creation events with parent/child image paths and full command-line strings.
references:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/devil-bait/NCSC-MAR-Devil-Bait.pdf
  - https://www.virustotal.com/gui/file/fa71eee906a7849ba3f4bab74edb577bd1f1f8397ca428591b4a9872ce1f1e9b/behavior
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Malware/Devil-Bait/proc_creation_win_malware_devil_bait_output_redirect.yml
author: Nasreddine Bencherchali (Nextron Systems), NCSC (Idea), Huntrule Team
date: 2023-05-15
modified: 2025-10-19
tags:
  - attack.stealth
  - attack.t1218
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_redirect:
    ParentImage|endswith: \wscript.exe
    Image|endswith: \cmd.exe
    CommandLine|contains: ">>%APPDATA%\\Microsoft\\"
    CommandLine|endswith:
      - .xml
      - .txt
  selection_recon_cmd:
    - CommandLine|re: ipconfig\s+/all
    - CommandLine|contains:
        - dir
        - systeminfo
        - tasklist
  condition: all of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1

What it detects

This rule identifies Windows process activity where wscript.exe spawns cmd.exe that redirects output to a path under %APPDATA%\Microsoft, writing .xml or .txt files. It further matches command-line reconnaissance behavior commonly used for local system discovery, including ipconfig /all plus commands such as dir, systeminfo, and tasklist. Attackers rely on this staged discovery to profile the host and prepare for follow-on intrusion. Telemetry required includes process creation events with parent/child image paths and full command-line strings.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.