Windows Wscript/Cscript Executes Files with Uncommon Non-Script Extensions

title: Windows Wscript/Cscript Executes Files with Uncommon Non-Script Extensions
id: 5bbb719c-eeff-4e67-a0a7-b75a3af8891b
status: test
description: This rule identifies executions where wscript.exe or cscript.exe runs a command line containing a file name with an uncommon extension such as .csv, .dat, .doc, .gif, .jpeg, .jpg, .png, .ppt, .txt, .xls, or .xml. Attackers may use Windows Script Host to launch or process content masquerading as a script by leveraging non-script extensions. It relies on process creation telemetry, matching the script host executable and inspecting the command line for specific file extensions.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wscript_cscript_uncommon_extension_exec.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-15
modified: 2023-06-19
tags:
  - attack.execution
  - attack.t1059.005
  - attack.t1059.007
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - OriginalFileName:
        - wscript.exe
        - cscript.exe
    - Image|endswith:
        - \wscript.exe
        - \cscript.exe
  selection_extension:
    CommandLine|contains:
      - .csv
      - .dat
      - .doc
      - .gif
      - .jpeg
      - .jpg
      - .png
      - .ppt
      - .txt
      - .xls
      - .xml
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 99b7460d-c9f1-40d7-a316-1f36f61d52ee
    type: derived