Windows Script Execution from User-Accessible Paths via WScript, CScript, or MSHTA
Alerts when WScript/CScript/MSHTA launches scripts or HTAs referenced from user and temp directories.
- Product
- windows
- Category
- process_creation
- Author
- Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community, Nasreddine Bencherchali (Nextron Systems), Dave Johnson (SigmaHQ), DRL 1.1
- Published
- 2019-01-16
- Updated
- 2026-07-30
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process executions of wscript.exe, cscript.exe, or mshta.exe where the command line includes script or HTA-related extensions and the content appears to come from common user and temporary directories. Attackers frequently use these Windows scripting host utilities to run embedded or staged payloads from writable locations, helping their code execute without typical script installers. The detection relies on Windows process creation telemetry, matching on executable names and command-line substrings indicating both script types and potentially user-accessible paths.
Reporting behind it
- thedfirreport.comhttps://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/
- redcanary.comhttps://redcanary.com/blog/gootloader/
- microsoft.comhttps://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wscript_cscript_mshta_dropper.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Script Execution from User-Accessible Paths via WScript, CScript, or MSHTA
id: a8aceb63-d31f-414c-a501-f143819f749c
related:
- id: 1e33157c-53b1-41ad-bbcc-780b80b58288
type: similar
- id: cea72823-df4d-4567-950c-0b579eaf0846
type: derived
status: test
description: This rule flags process executions of wscript.exe, cscript.exe, or mshta.exe where the command line includes script or HTA-related extensions and the content appears to come from common user and temporary directories. Attackers frequently use these Windows scripting host utilities to run embedded or staged payloads from writable locations, helping their code execute without typical script installers. The detection relies on Windows process creation telemetry, matching on executable names and command-line substrings indicating both script types and potentially user-accessible paths.
references:
- https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/
- https://redcanary.com/blog/gootloader/
- https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wscript_cscript_mshta_dropper.yml
author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community, Nasreddine Bencherchali (Nextron Systems), Dave Johnson, Huntrule Team
date: 2019-01-16
modified: 2026-02-17
tags:
- attack.execution
- attack.t1059.005
- attack.t1059.007
logsource:
category: process_creation
product: windows
detection:
selection_exec:
Image|endswith:
- \wscript.exe
- \cscript.exe
- \mshta.exe
selection_paths:
CommandLine|contains:
- :\Perflogs\
- :\Temp\
- :\Tmp\
- :\Users\Public\
- :\Windows\Temp\
- \AppData\Local\Temp\
- \AppData\Roaming\Temp\
- \Start Menu\Programs\Startup\
- \Temporary Internet
- \Windows\Temp
- "%LocalAppData%\\Temp\\"
- "%TEMP%"
- "%TMP%"
selection_ext:
CommandLine|contains:
- .hta
- .js
- .jse
- .vba
- .vbe
- .vbs
- .wsf
- .wsh
condition: all of selection_*
falsepositives:
- Some installers might generate a similar behavior. An initial baseline is required
level: medium
license: DRL-1.1