Windows Devil Bait-like Recon via Wscript/Cmd with APPDATA Redirection

Flags cmd.exe launched by wscript.exe to redirect discovery output into %APPDATA%\Microsoft (.xml/.txt) using system enumeration commands.

FreeReviewedSigma · High · v5

Product: windows
Category: process_creation
Author: Nasreddine Bencherchali (Nextron Systems), NCSC (Idea) (SigmaHQ), DRL 1.1
Published: 2023-05-15
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1218System Binary Proxy Execution
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule looks for a specific process chain where a child process created by wscript.exe launches cmd.exe and includes output redirection into the %APPDATA%\Microsoft\ path. It further requires cmd.exe to run reconnaissance-style commands such as ipconfig /all and combinations of dir, systeminfo, and tasklist. This behavior matters because it aligns with malware staging that collects host/network information and writes it to user-writable locations. The detection relies on process creation telemetry with parent/child image paths and command-line contents on Windows.

Reporting behind it

Related detections9 linkedT1218 — drag to rearrange

Suspicious Cabinet Extraction of Masqueraded vstm Archive via extrac32

Malicious DLL Execution via Wuauclt Update Handler (via process_creation)

Malicious aspnet_compiler.exe Injection Host Spawned by PowerShell via process_creation

Malicious regsvcs LOLBin Loading Ransomware DLL from UNC Path

Suspicious RegAsm or RegSvcs Spawned by Script Host (via process_creation)

Suspicious Extexport DLL Side-Loading Execution

Malicious ClickFix Execution Chain Spawning MSHTA via Pcalua on EtherRAT Infection

Suspicious TALONITE Certutil LOLBIN Decode and Download Abuse (via process_creation)

Suspicious Renamed git Binary gcmd.exe Execution (via process_creation)

Windows Devil Bait-like Recon via Wscript/Cmd with APPDATA Redirection

Pivot detection · T1218 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-recon-via-wscript-cmd-redirection-to-appdata-devil-bait-e8954be4

title: Windows Devil Bait-like Recon via Wscript/Cmd with APPDATA Redirection
id: a3807b67-603a-456c-848d-521ed56c16b1
related:
  - id: 8e0bb260-d4b2-4fff-bb8d-3f82118e6892
    type: derived
  - id: e8954be4-b2b8-4961-be18-da1a5bda709c
    type: derived
status: test
description: This rule looks for a specific process chain where a child process created by wscript.exe launches cmd.exe and includes output redirection into the %APPDATA%\Microsoft\ path. It further requires cmd.exe to run reconnaissance-style commands such as ipconfig /all and combinations of dir, systeminfo, and tasklist. This behavior matters because it aligns with malware staging that collects host/network information and writes it to user-writable locations. The detection relies on process creation telemetry with parent/child image paths and command-line contents on Windows.
references:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/devil-bait/NCSC-MAR-Devil-Bait.pdf
  - https://www.virustotal.com/gui/file/fa71eee906a7849ba3f4bab74edb577bd1f1f8397ca428591b4a9872ce1f1e9b/behavior
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Malware/Devil-Bait/proc_creation_win_malware_devil_bait_output_redirect.yml
author: Nasreddine Bencherchali (Nextron Systems), NCSC (Idea), Huntrule Team
date: 2023-05-15
modified: 2025-10-19
tags:
  - attack.stealth
  - attack.t1218
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_redirect:
    ParentImage|endswith: \wscript.exe
    Image|endswith: \cmd.exe
    CommandLine|contains: ">>%APPDATA%\\Microsoft\\"
    CommandLine|endswith:
      - .xml
      - .txt
  selection_recon_cmd:
    - CommandLine|re: ipconfig\s+/all
    - CommandLine|contains:
        - dir
        - systeminfo
        - tasklist
  condition: all of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL