Windows Script Interpreter Execution From Suspicious Folders via Command-Line Flags

title: Windows Script Interpreter Execution From Suspicious Folders via Command-Line Flags
id: fab1d2e3-6c14-4b8b-810b-7fbe5b9d6fb0
status: test
description: This rule identifies Windows process creation where script interpreters (cscript.exe, wscript.exe, mshta.exe, and related) are launched with command-line flags consistent with execution policy bypass, hidden execution, or embedded script payloads. It further narrows matches to executions originating from suspicious directories or user-accessible locations referenced via environment variables (for example TEMP, Public, Start Menu Startup, or user Favorites/Documents subfolders). The intent is to catch attacker attempts to run scripts from writable or masquerading locations, using telemetry from process creation including Image, OriginalFileName, ParentImage, and full CommandLine.
references:
  - https://www.virustotal.com/gui/file/91ba814a86ddedc7a9d546e26f912c541205b47a853d227756ab1334ade92c3f
  - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-russia-ukraine-military
  - https://learn.microsoft.com/en-us/windows/win32/shell/csidl
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_script_exec_from_env_folder.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-02-08
modified: 2026-02-17
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_proc_image:
    Image|endswith:
      - \cscript.exe
      - \mshta.exe
      - \wscript.exe
  selection_proc_flags:
    CommandLine|contains:
      - " -ep bypass "
      - " -ExecutionPolicy bypass "
      - " -w hidden "
      - "/e:javascript "
      - "/e:Jscript "
      - "/e:vbscript "
  selection_proc_original:
    OriginalFileName:
      - cscript.exe
      - mshta.exe
      - wscript.exe
  selection_folders_1:
    CommandLine|contains:
      - :\Perflogs\
      - :\Users\Public\
      - \%Public%
      - \AppData\Local\Temp
      - \AppData\Roaming\Temp
      - \Temporary Internet
      - \Windows\Temp
      - \Start Menu\Programs\Startup\
      - "%TEMP%"
      - "%TMP%"
      - "%LocalAppData%\\Temp"
  selection_folders_2:
    - CommandLine|contains|all:
        - :\Users\
        - \Favorites\
    - CommandLine|contains|all:
        - :\Users\
        - \Favourites\
    - CommandLine|contains|all:
        - :\Users\
        - \Contacts\
    - CommandLine|contains|all:
        - :\Users\
        - \Documents\
    - CommandLine|contains|all:
        - :\Users\
        - \Music\
    - CommandLine|contains|all:
        - :\Users\
        - \Pictures\
    - CommandLine|contains|all:
        - :\Users\
        - \Videos\
  filter_optional_chocolatey_installer:
    ParentImage:
      - C:\Windows\System32\Msiexec.exe
      - C:\Windows\SysWOW64\Msiexec.exe
    Image|endswith: \powershell.exe
    CommandLine|contains|all:
      - -NoProfile -ExecutionPolicy Bypass -Command
      - AppData\Local\Temp\
      - Install-Chocolatey.ps1
  condition: 1 of selection_proc_* and 1 of selection_folders_* and not 1 of filter_optional_*
falsepositives:
  - Various legitimate software have been observed to use similar techniques for installation or update purposes;thus, it is recommended to review and tune filters for your environment to reduce false positives before deploying to production.
level: high
license: DRL-1.1
related:
  - id: 1228c958-e64e-4e71-92ad-7d429f4138ba
    type: derived