huntrule

Windows WScript/CScript File Write With Script Extensions to Temp or Startup Paths

Alerts when WScript/CScript writes script files (.js/.vbs/.wsf/.wsh, etc.) into common temp or Startup directories.

FreeReviewedSigma · High · v2
Product
windows
Category
file_event
Author
Tim Shelton (SigmaHQ), DRL 1.1
Published
2022-01-10
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags file creation or writing events where WScript.exe or CScript.exe targets files with script-related extensions (.js, .jse, .vba, .vbe, .vbs, .wsf, .wsh). It focuses on common locations attackers use for staging or persistence, including Perflogs, ProgramData, Temp/Tmp, user and Windows temp directories, and Startup folders. The detection relies on Windows file event telemetry that includes the executing image path and the target filename, plus matching on both extension and specific directory substrings.

Reporting behind it

Related detections9 linkedT1059.005 — drag to rearrange
Suspicious Script Host Execution of Decoy-Named JavaScript Dropper (PS1Bot)
Suspicious Wscript Execution of JavaScript From AppData Local Temp via Process Creation (via process_creation)
Windows AppLocker Audit-Mode Events Indicate Files Would Have Been Blocked
Windows Wscript/Cscript Executes Files with Uncommon Non-Script Extensions
Windows AppLocker Blocked Application, Script, MSI, or Packaged-App Execution
Windows Process Creation: Suspicious Children Spawned by HTML Help (hh.exe)
Windows: Alert on Suspicious HH.EXE Process Execution
Windows: Koadic Command Prompt Invocation with /q /c chcp
Windows: Alert on suspicious parent process spawning csc.exe
Windows WScript/CScript File Write With Script Extensions to Temp or Startup Paths
Pivot detection · T1059.005 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.