Windows Devil Bait-like Recon via Wscript/Cmd with APPDATA Redirection
Flags cmd.exe launched by wscript.exe to redirect discovery output into %APPDATA%\Microsoft (.xml/.txt) using system enumeration commands.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems), NCSC (Idea) (SigmaHQ), DRL 1.1
- Published
- 2023-05-15
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule looks for a specific process chain where a child process created by wscript.exe launches cmd.exe and includes output redirection into the %APPDATA%\Microsoft\ path. It further requires cmd.exe to run reconnaissance-style commands such as ipconfig /all and combinations of dir, systeminfo, and tasklist. This behavior matters because it aligns with malware staging that collects host/network information and writes it to user-writable locations. The detection relies on process creation telemetry with parent/child image paths and command-line contents on Windows.
Reporting behind it
- ncsc.gov.ukhttps://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/devil-bait/NCSC-MAR-Devil-Bait.pdf
- virustotal.comhttps://www.virustotal.com/gui/file/fa71eee906a7849ba3f4bab74edb577bd1f1f8397ca428591b4a9872ce1f1e9b/behavior
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Malware/Devil-Bait/proc_creation_win_malware_devil_bait_output_redirect.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Devil Bait-like Recon via Wscript/Cmd with APPDATA Redirection
id: a3807b67-603a-456c-848d-521ed56c16b1
related:
- id: 8e0bb260-d4b2-4fff-bb8d-3f82118e6892
type: derived
- id: e8954be4-b2b8-4961-be18-da1a5bda709c
type: derived
status: test
description: This rule looks for a specific process chain where a child process created by wscript.exe launches cmd.exe and includes output redirection into the %APPDATA%\Microsoft\ path. It further requires cmd.exe to run reconnaissance-style commands such as ipconfig /all and combinations of dir, systeminfo, and tasklist. This behavior matters because it aligns with malware staging that collects host/network information and writes it to user-writable locations. The detection relies on process creation telemetry with parent/child image paths and command-line contents on Windows.
references:
- https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/devil-bait/NCSC-MAR-Devil-Bait.pdf
- https://www.virustotal.com/gui/file/fa71eee906a7849ba3f4bab74edb577bd1f1f8397ca428591b4a9872ce1f1e9b/behavior
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Malware/Devil-Bait/proc_creation_win_malware_devil_bait_output_redirect.yml
author: Nasreddine Bencherchali (Nextron Systems), NCSC (Idea), Huntrule Team
date: 2023-05-15
modified: 2025-10-19
tags:
- attack.stealth
- attack.t1218
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection_redirect:
ParentImage|endswith: \wscript.exe
Image|endswith: \cmd.exe
CommandLine|contains: ">>%APPDATA%\\Microsoft\\"
CommandLine|endswith:
- .xml
- .txt
selection_recon_cmd:
- CommandLine|re: ipconfig\s+/all
- CommandLine|contains:
- dir
- systeminfo
- tasklist
condition: all of selection_*
falsepositives:
- Unlikely
level: high
license: DRL-1.1