Windows Script Interpreter Initiates Outbound Network Connections to Non-Local IPs

title: Windows Script Interpreter Initiates Outbound Network Connections to Non-Local IPs
id: 0a8c64d6-618e-4396-8b1e-54374e9bb704
related:
  - id: 08249dc0-a28d-4555-8ba5-9255a198e08c
    type: derived
  - id: 992a6cae-db6a-43c8-9cec-76d7195c96fc
    type: derived
status: test
description: This rule identifies outbound network connections initiated by the Windows script interpreters wscript.exe or cscript.exe to destination IPs outside common local/private ranges. Such behavior is important because script interpreters are often leveraged to retrieve remote content or stage follow-on activity during command-and-control. It relies on network connection telemetry that includes the initiating process and the destination IP address for filtering out local address space.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/28d190330fe44de6ff4767fc400cc10fa7cd6540/atomics/T1105/T1105.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_wscript_cscript_outbound_connection.yml
author: frack113, Florian Roth (Nextron Systems), Huntrule Team
date: 2022-08-28
modified: 2024-03-13
tags:
  - attack.command-and-control
  - attack.t1105
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: "true"
    Image|endswith:
      - \wscript.exe
      - \cscript.exe
  filter_main_local_ranges:
    DestinationIp|cidr:
      - 127.0.0.0/8
      - 10.0.0.0/8
      - 172.16.0.0/12
      - 192.168.0.0/16
      - 169.254.0.0/16
      - ::1/128
      - fe80::/10
      - fc00::/7
  filter_main_ms_ranges:
    DestinationIp|cidr: 20.0.0.0/11
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Legitimate scripts
level: high
license: DRL-1.1