Windows Script Interpreter Execution from Extracted Compressed Files (7zip/WinRAR/Explorer)

Flags parent 7zip/WinRAR/Explorer temp extraction leading to execution of script interpreters such as PowerShell or HTA.

FreeUnreviewedSigmamediumv1

windows-script-interpreter-execution-from-extracted-compressed-files-7zip-winrar-95724fc1

title: Windows Script Interpreter Execution from Extracted Compressed Files (7zip/WinRAR/Explorer)
id: c4230fbf-41e7-4f29-b244-43bbd7bc0418
status: test
description: This rule identifies Windows process chains where a script interpreter (cscript, mshta, powershell/pwsh, wscript) is launched and the parent process indicates the script was extracted from a compressed archive. It covers scenarios where archives are opened via 7zip, WinRAR, or native File Explorer and the extraction occurs under a temporary path. This behavior matters because attackers often hide scripts inside archives and rely on built-in interpreters to execute them after extraction, so the telemetry relies on process creation events with matching parent Image and CommandLine patterns plus the child interpreter Image and script-suffix arguments.
references:
  - https://app.any.run/tasks/25970bb5-f864-4e9e-9e1b-cc8ff9e6386a
  - https://app.any.run/tasks/fa99cedc-9d2f-4115-a08e-291429ce3692
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_susp_script_exec_from_compressed_parent.yml
author: "@kostastsale, Huntrule Team"
date: 2023-02-15
modified: 2024-08-13
tags:
  - attack.execution
  - attack.t1059
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent_7zip:
    ParentImage|endswith: \7z*.exe
    CommandLine|contains: \AppData\local\temp\7z*\
  selection_parent_winrar:
    ParentImage|endswith: \winrar.exe
    CommandLine|contains: \AppData\local\temp\rar*\
  selection_parent_explorer:
    ParentImage|endswith: \explorer.exe
    CommandLine|contains:
      - \AppData\local\temp\*.rar\
      - \AppData\local\temp\*.zip\
  selection_child:
    Image|endswith:
      - \cscript.exe
      - \mshta.exe
      - \powershell.exe
      - \pwsh.exe
      - \wscript.exe
    CommandLine|endswith:
      - .hta
      - .js
      - .jse
      - .ps1
      - .vbe
      - .vbs
      - .wsf
      - .wsh
  condition: 1 of selection_parent_* and selection_child
falsepositives:
  - Batch files may produce a lot of noise, as many applications appear to bundle them as part of their installation process. You should baseline your environment and generate a new query excluding the noisy and expected activity. Some false positives may come up depending on your environment. All results should be investigated thoroughly before filtering out results.
level: medium
license: DRL-1.1
related:
  - id: 95724fc1-a258-4674-97db-a30351981c5a
    type: derived

What it detects

This rule identifies Windows process chains where a script interpreter (cscript, mshta, powershell/pwsh, wscript) is launched and the parent process indicates the script was extracted from a compressed archive. It covers scenarios where archives are opened via 7zip, WinRAR, or native File Explorer and the extraction occurs under a temporary path. This behavior matters because attackers often hide scripts inside archives and rely on built-in interpreters to execute them after extraction, so the telemetry relies on process creation events with matching parent Image and CommandLine patterns plus the child interpreter Image and script-suffix arguments.

Known false positives

Batch files may produce a lot of noise, as many applications appear to bundle them as part of their installation process. You should baseline your environment and generate a new query excluding the noisy and expected activity. Some false positives may come up depending on your environment. All results should be investigated thoroughly before filtering out results.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.