Windows: Scriptrunner.exe process execution with App-V script parameters

Flags ScriptRunner.exe executions that include the " -appvscript " parameter in the command line.

FreeUnreviewedSigmamediumv1

windows-scriptrunner-exe-process-execution-with-app-v-script-parameters-64760eef

title: "Windows: Scriptrunner.exe process execution with App-V script parameters"
id: 8587c1e3-d228-4a62-9d61-29a70f94ecb3
status: test
description: This rule identifies Windows processes where ScriptRunner.exe is executed with command-line content indicating App-V script execution via the " -appvscript " parameter. Attackers may use this binary to proxy or wrap execution, potentially helping evade application allowlisting. The detection relies on process creation telemetry including the image path, OriginalFileName, and the full command line.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Scriptrunner/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_scriptrunner.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-01
tags:
  - attack.execution
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \ScriptRunner.exe
    - OriginalFileName: ScriptRunner.exe
  selection_cli:
    CommandLine|contains: " -appvscript "
  condition: all of selection*
falsepositives:
  - Legitimate use when App-v is deployed
level: medium
license: DRL-1.1
related:
  - id: 64760eef-87f7-4ed3-93fd-655668ea9420
    type: derived

What it detects

This rule identifies Windows processes where ScriptRunner.exe is executed with command-line content indicating App-V script execution via the " -appvscript " parameter. Attackers may use this binary to proxy or wrap execution, potentially helping evade application allowlisting. The detection relies on process creation telemetry including the image path, OriginalFileName, and the full command line.

Known false positives

Legitimate use when App-v is deployed

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.