huntrule

Windows Process Execution of Script Interpreters After Extraction from Compressed Files

Flags parent 7zip/WinRAR/Explorer temp extraction leading to execution of script interpreters such as PowerShell or HTA.

FreeReviewedSigma · Medium · v5
Product
windows
Category
process_creation
Author
@kostastsale (SigmaHQ), DRL 1.1
Published
2023-02-15
Updated
2026-07-31
AnalysisDetection
title: Windows Process Execution of Script Interpreters After Extraction from Compressed Files
id: c4230fbf-41e7-4f29-b244-43bbd7bc0418
status: test
description: This rule identifies interactive script execution on Windows where a script interpreter process (cscript, mshta, powershell/pwsh, or wscript) starts with a script file extension (.js, .ps1, .vbs, etc.) shortly after a compressed archive is processed by 7zip, WinRAR, or Explorer. The behavior matters because it can indicate malicious content being extracted to temporary directories and then launched through native scripting interpreters. The detection relies on process creation telemetry, matching parent processes and command-line paths in AppData\local\temp followed by child interpreter execution with script-suffix command lines.
references:
  - https://app.any.run/tasks/25970bb5-f864-4e9e-9e1b-cc8ff9e6386a
  - https://app.any.run/tasks/fa99cedc-9d2f-4115-a08e-291429ce3692
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_susp_script_exec_from_compressed_parent.yml
author: "@kostastsale, Huntrule Team"
date: 2023-02-15
modified: 2024-08-13
tags:
  - attack.execution
  - attack.t1059
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent_7zip:
    ParentImage|endswith: \7z*.exe
    CommandLine|contains: \AppData\local\temp\7z*\
  selection_parent_winrar:
    ParentImage|endswith: \winrar.exe
    CommandLine|contains: \AppData\local\temp\rar*\
  selection_parent_explorer:
    ParentImage|endswith: \explorer.exe
    CommandLine|contains:
      - \AppData\local\temp\*.rar\
      - \AppData\local\temp\*.zip\
  selection_child:
    Image|endswith:
      - \cscript.exe
      - \mshta.exe
      - \powershell.exe
      - \pwsh.exe
      - \wscript.exe
    CommandLine|endswith:
      - .hta
      - .js
      - .jse
      - .ps1
      - .vbe
      - .vbs
      - .wsf
      - .wsh
  condition: 1 of selection_parent_* and selection_child
falsepositives:
  - Batch files may produce a lot of noise, as many applications appear to bundle them as part of their installation process. You should baseline your environment and generate a new query excluding the noisy and expected activity. Some false positives may come up depending on your environment. All results should be investigated thoroughly before filtering out results.
level: medium
license: DRL-1.1
related:
  - id: 95724fc1-a258-4674-97db-a30351981c5a
    type: derived