Windows File Events: VBS gatherNetworkInfo results file creation
Flags Windows file writes under System32\config consistent with gatherNetworkInfo.vbs network reconnaissance output.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-02-08
- Updated
- 2026-07-31
What it detects
This rule identifies file creation events for output artifacts associated with executing the built-in reconnaissance script C:\Windows\System32\gatherNetworkInfo.vbs. Attackers may run this script to quickly collect network configuration and state, then store results in specific files for later review. The detection relies on Windows file event telemetry matching TargetFilename paths under C:\Windows\System32\config with particular result filenames.
Reporting behind it
- posts.slayerlabs.comhttps://posts.slayerlabs.com/living-off-the-land/#gathernetworkinfovbs
- mandiant.comhttps://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_lolbin_gather_network_info_script_output.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-vbs-gathernetworkinfo-output-files-written-to-system32-config-f92a6f1e
title: "Windows File Events: VBS gatherNetworkInfo results file creation"
id: 7747a65d-9d31-454d-8748-cd002468c457
related:
- id: 575dce0c-8139-4e30-9295-1ee75969f7fe
type: similar
- id: 07aa184a-870d-413d-893a-157f317f6f58
type: similar
- id: f92a6f1e-a512-4a15-9735-da09e78d7273
type: derived
status: test
description: This rule identifies file creation events for output artifacts associated with executing the built-in reconnaissance script C:\Windows\System32\gatherNetworkInfo.vbs. Attackers may run this script to quickly collect network configuration and state, then store results in specific files for later review. The detection relies on Windows file event telemetry matching TargetFilename paths under C:\Windows\System32\config with particular result filenames.
references:
- https://posts.slayerlabs.com/living-off-the-land/#gathernetworkinfovbs
- https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_lolbin_gather_network_info_script_output.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-02-08
tags:
- attack.discovery
logsource:
product: windows
category: file_event
detection:
selection:
TargetFilename|startswith: C:\Windows\System32\config
TargetFilename|endswith:
- \Hotfixinfo.txt
- \netiostate.txt
- \sysportslog.txt
- \VmSwitchLog.evtx
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1