Windows Process Execution of Script Interpreters After Extraction from Compressed Files

Flags parent 7zip/WinRAR/Explorer temp extraction leading to execution of script interpreters such as PowerShell or HTA.

FreeReviewedSigma · Medium · v5

Product: windows
Category: process_creation
Author: @kostastsale (SigmaHQ), DRL 1.1
Published: 2023-02-15
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1059Command and Scripting Interpreter
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies interactive script execution on Windows where a script interpreter process (cscript, mshta, powershell/pwsh, or wscript) starts with a script file extension (.js, .ps1, .vbs, etc.) shortly after a compressed archive is processed by 7zip, WinRAR, or Explorer. The behavior matters because it can indicate malicious content being extracted to temporary directories and then launched through native scripting interpreters. The detection relies on process creation telemetry, matching parent processes and command-line paths in AppData\local\temp followed by child interpreter execution with script-suffix command lines.

Reporting behind it

Related detections9 linkedT1059 — drag to rearrange

Suspicious OneNote Spawning Command or Script Interpreter via Spear-Phishing (via process_creation)

Malicious Web Server Process Spawning Command Interpreter via Web Shell (via process_creation)

Suspicious VMware Guest Operation Output Staging in vmware-system Temp Directory (via file_event)

Malicious Command Shell Spawned by SQL Server via Process Creation (via process_creation)

Suspicious Script Interpreter Spawned by Excel via DarkGate Lure

Suspicious AutoHotkey Script Execution from User Writable Path by DarkGate

Malicious China Chopper Web Shell Command Pattern in IIS Worker Process (via process_creation)

Malicious AutoHotKey Runner AutoNotify Executing AHKBot Looper Script (via process_creation)

Malicious IIS Worker Process Spawning Command Shell after ASP.NET ViewState Injection (via process_creation)

Windows Process Execution of Script Interpreters After Extraction from Compressed Files

Pivot detection · T1059 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-script-interpreter-execution-from-extracted-compressed-files-7zip-winrar-95724fc1

title: Windows Process Execution of Script Interpreters After Extraction from Compressed Files
id: c4230fbf-41e7-4f29-b244-43bbd7bc0418
status: test
description: This rule identifies interactive script execution on Windows where a script interpreter process (cscript, mshta, powershell/pwsh, or wscript) starts with a script file extension (.js, .ps1, .vbs, etc.) shortly after a compressed archive is processed by 7zip, WinRAR, or Explorer. The behavior matters because it can indicate malicious content being extracted to temporary directories and then launched through native scripting interpreters. The detection relies on process creation telemetry, matching parent processes and command-line paths in AppData\local\temp followed by child interpreter execution with script-suffix command lines.
references:
  - https://app.any.run/tasks/25970bb5-f864-4e9e-9e1b-cc8ff9e6386a
  - https://app.any.run/tasks/fa99cedc-9d2f-4115-a08e-291429ce3692
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_susp_script_exec_from_compressed_parent.yml
author: "@kostastsale, Huntrule Team"
date: 2023-02-15
modified: 2024-08-13
tags:
  - attack.execution
  - attack.t1059
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent_7zip:
    ParentImage|endswith: \7z*.exe
    CommandLine|contains: \AppData\local\temp\7z*\
  selection_parent_winrar:
    ParentImage|endswith: \winrar.exe
    CommandLine|contains: \AppData\local\temp\rar*\
  selection_parent_explorer:
    ParentImage|endswith: \explorer.exe
    CommandLine|contains:
      - \AppData\local\temp\*.rar\
      - \AppData\local\temp\*.zip\
  selection_child:
    Image|endswith:
      - \cscript.exe
      - \mshta.exe
      - \powershell.exe
      - \pwsh.exe
      - \wscript.exe
    CommandLine|endswith:
      - .hta
      - .js
      - .jse
      - .ps1
      - .vbe
      - .vbs
      - .wsf
      - .wsh
  condition: 1 of selection_parent_* and selection_child
falsepositives:
  - Batch files may produce a lot of noise, as many applications appear to bundle them as part of their installation process. You should baseline your environment and generate a new query excluding the noisy and expected activity. Some false positives may come up depending on your environment. All results should be investigated thoroughly before filtering out results.
level: medium
license: DRL-1.1
related:
  - id: 95724fc1-a258-4674-97db-a30351981c5a
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL