Windows Script Execution from User-Accessible Paths via WScript, CScript, or MSHTA

title: Windows Script Execution from User-Accessible Paths via WScript, CScript, or MSHTA
id: a8aceb63-d31f-414c-a501-f143819f749c
related:
  - id: 1e33157c-53b1-41ad-bbcc-780b80b58288
    type: similar
  - id: cea72823-df4d-4567-950c-0b579eaf0846
    type: derived
status: test
description: This rule flags process executions of wscript.exe, cscript.exe, or mshta.exe where the command line includes script or HTA-related extensions and the content appears to come from common user and temporary directories. Attackers frequently use these Windows scripting host utilities to run embedded or staged payloads from writable locations, helping their code execute without typical script installers. The detection relies on Windows process creation telemetry, matching on executable names and command-line substrings indicating both script types and potentially user-accessible paths.
references:
  - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/
  - https://redcanary.com/blog/gootloader/
  - https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wscript_cscript_mshta_dropper.yml
author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community, Nasreddine Bencherchali (Nextron Systems), Dave Johnson, Huntrule Team
date: 2019-01-16
modified: 2026-02-17
tags:
  - attack.execution
  - attack.t1059.005
  - attack.t1059.007
logsource:
  category: process_creation
  product: windows
detection:
  selection_exec:
    Image|endswith:
      - \wscript.exe
      - \cscript.exe
      - \mshta.exe
  selection_paths:
    CommandLine|contains:
      - :\Perflogs\
      - :\Temp\
      - :\Tmp\
      - :\Users\Public\
      - :\Windows\Temp\
      - \AppData\Local\Temp\
      - \AppData\Roaming\Temp\
      - \Start Menu\Programs\Startup\
      - \Temporary Internet
      - \Windows\Temp
      - "%LocalAppData%\\Temp\\"
      - "%TEMP%"
      - "%TMP%"
  selection_ext:
    CommandLine|contains:
      - .hta
      - .js
      - .jse
      - .vba
      - .vbe
      - .vbs
      - .wsf
      - .wsh
  condition: all of selection_*
falsepositives:
  - Some installers might generate a similar behavior. An initial baseline is required
level: medium
license: DRL-1.1