huntrule

Windows Wscript/Cscript Executes Files with Uncommon Non-Script Extensions

Flags wscript.exe/cscript.exe launching files named with uncommon non-script extensions via command-line content.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2023-05-15
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies executions where wscript.exe or cscript.exe runs a command line containing a file name with an uncommon extension such as .csv, .dat, .doc, .gif, .jpeg, .jpg, .png, .ppt, .txt, .xls, or .xml. Attackers may use Windows Script Host to launch or process content masquerading as a script by leveraging non-script extensions. It relies on process creation telemetry, matching the script host executable and inspecting the command line for specific file extensions.

Reporting behind it

Related detections9 linkedT1059.005 — drag to rearrange
Suspicious Script Host Execution of Decoy-Named JavaScript Dropper (PS1Bot)
Suspicious Wscript Execution of JavaScript From AppData Local Temp via Process Creation (via process_creation)
Windows AppLocker Audit-Mode Events Indicate Files Would Have Been Blocked
Windows WScript/CScript File Write With Script Extensions to Temp or Startup Paths
Windows AppLocker Blocked Application, Script, MSI, or Packaged-App Execution
Windows Process Creation: Suspicious Children Spawned by HTML Help (hh.exe)
Windows: Alert on Suspicious HH.EXE Process Execution
Windows: Koadic Command Prompt Invocation with /q /c chcp
Windows: Alert on suspicious parent process spawning csc.exe
Windows Wscript/Cscript Executes Files with Uncommon Non-Script Extensions
Pivot detection · T1059.005 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.