Windows Process Execution of Script Interpreters After Extraction from Compressed Files
Flags parent 7zip/WinRAR/Explorer temp extraction leading to execution of script interpreters such as PowerShell or HTA.
- Product
- windows
- Category
- process_creation
- Author
- @kostastsale (SigmaHQ), DRL 1.1
- Published
- 2023-02-15
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies interactive script execution on Windows where a script interpreter process (cscript, mshta, powershell/pwsh, or wscript) starts with a script file extension (.js, .ps1, .vbs, etc.) shortly after a compressed archive is processed by 7zip, WinRAR, or Explorer. The behavior matters because it can indicate malicious content being extracted to temporary directories and then launched through native scripting interpreters. The detection relies on process creation telemetry, matching parent processes and command-line paths in AppData\local\temp followed by child interpreter execution with script-suffix command lines.
Reporting behind it
- app.any.runhttps://app.any.run/tasks/25970bb5-f864-4e9e-9e1b-cc8ff9e6386a
- app.any.runhttps://app.any.run/tasks/fa99cedc-9d2f-4115-a08e-291429ce3692
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_susp_script_exec_from_compressed_parent.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Process Execution of Script Interpreters After Extraction from Compressed Files
id: c4230fbf-41e7-4f29-b244-43bbd7bc0418
status: test
description: This rule identifies interactive script execution on Windows where a script interpreter process (cscript, mshta, powershell/pwsh, or wscript) starts with a script file extension (.js, .ps1, .vbs, etc.) shortly after a compressed archive is processed by 7zip, WinRAR, or Explorer. The behavior matters because it can indicate malicious content being extracted to temporary directories and then launched through native scripting interpreters. The detection relies on process creation telemetry, matching parent processes and command-line paths in AppData\local\temp followed by child interpreter execution with script-suffix command lines.
references:
- https://app.any.run/tasks/25970bb5-f864-4e9e-9e1b-cc8ff9e6386a
- https://app.any.run/tasks/fa99cedc-9d2f-4115-a08e-291429ce3692
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_susp_script_exec_from_compressed_parent.yml
author: "@kostastsale, Huntrule Team"
date: 2023-02-15
modified: 2024-08-13
tags:
- attack.execution
- attack.t1059
- detection.threat-hunting
logsource:
category: process_creation
product: windows
detection:
selection_parent_7zip:
ParentImage|endswith: \7z*.exe
CommandLine|contains: \AppData\local\temp\7z*\
selection_parent_winrar:
ParentImage|endswith: \winrar.exe
CommandLine|contains: \AppData\local\temp\rar*\
selection_parent_explorer:
ParentImage|endswith: \explorer.exe
CommandLine|contains:
- \AppData\local\temp\*.rar\
- \AppData\local\temp\*.zip\
selection_child:
Image|endswith:
- \cscript.exe
- \mshta.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
CommandLine|endswith:
- .hta
- .js
- .jse
- .ps1
- .vbe
- .vbs
- .wsf
- .wsh
condition: 1 of selection_parent_* and selection_child
falsepositives:
- Batch files may produce a lot of noise, as many applications appear to bundle them as part of their installation process. You should baseline your environment and generate a new query excluding the noisy and expected activity. Some false positives may come up depending on your environment. All results should be investigated thoroughly before filtering out results.
level: medium
license: DRL-1.1
related:
- id: 95724fc1-a258-4674-97db-a30351981c5a
type: derived