Windows WScript/CScript Script File Dropper via File Write to Scripting Extensions

title: Windows WScript/CScript Script File Dropper via File Write to Scripting Extensions
id: 6c1da4a1-a6f2-4755-9d47-0717d02aa700
related:
  - id: cea72823-df4d-4567-950c-0b579eaf0846
    type: derived
  - id: 002bdb95-0cf1-46a6-9e08-d38c128a6127
    type: derived
status: test
description: This rule flags file creation events where the writing process is wscript.exe or cscript.exe and the target filename includes common temporary and startup locations and ends with script-related extensions (.js, .jse, .vba, .vbe, .vbs, .wsf, .wsh). Attackers often use WScript/CScript to materialize script payloads onto disk for later execution, which can blend into normal scripting activity. The detection relies on Windows file event telemetry capturing the image path of the process writing the file and the target filename/location and extension.
references:
  - WScript or CScript Dropper (cea72823-df4d-4567-950c-0b579eaf0846)
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_cscript_wscript_dropper.yml
author: Tim Shelton, Huntrule Team
date: 2022-01-10
modified: 2026-02-17
tags:
  - attack.execution
  - attack.t1059.005
  - attack.t1059.007
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
      - \wscript.exe
      - \cscript.exe
    TargetFilename|contains:
      - :\Perflogs\
      - :\ProgramData\
      - :\Temp\
      - :\Tmp\
      - :\Users\
      - :\Windows\Temp\
      - \AppData\Local\Temp
      - \AppData\Roaming\Temp
      - \Start Menu\Programs\Startup\
      - \Temporary Internet
    TargetFilename|endswith:
      - .js
      - .jse
      - .vba
      - .vbe
      - .vbs
      - .wsf
      - .wsh
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1