Windows WScript/CScript File Write With Script Extensions to Temp or Startup Paths

Alerts when WScript/CScript writes script files (.js/.vbs/.wsf/.wsh, etc.) into common temp or Startup directories.

FreeReviewedSigma · High · v2

Product: windows
Category: file_event
Author: Tim Shelton (SigmaHQ), DRL 1.1
Published: 2022-01-10
Updated: 2026-07-31

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1059.005Visual Basic
- T1059.007JavaScript
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags file creation or writing events where WScript.exe or CScript.exe targets files with script-related extensions (.js, .jse, .vba, .vbe, .vbs, .wsf, .wsh). It focuses on common locations attackers use for staging or persistence, including Perflogs, ProgramData, Temp/Tmp, user and Windows temp directories, and Startup folders. The detection relies on Windows file event telemetry that includes the executing image path and the target filename, plus matching on both extension and specific directory substrings.

Reporting behind it

Related detections9 linkedT1059.005 — drag to rearrange

Suspicious Script Host Execution of Decoy-Named JavaScript Dropper (PS1Bot)

Suspicious Wscript Execution of JavaScript From AppData Local Temp via Process Creation (via process_creation)

Windows AppLocker Audit-Mode Events Indicate Files Would Have Been Blocked

Windows Wscript/Cscript Executes Files with Uncommon Non-Script Extensions

Windows AppLocker Blocked Application, Script, MSI, or Packaged-App Execution

Windows Process Creation: Suspicious Children Spawned by HTML Help (hh.exe)

Windows: Alert on Suspicious HH.EXE Process Execution

Windows: Koadic Command Prompt Invocation with /q /c chcp

Windows: Alert on suspicious parent process spawning csc.exe

Windows WScript/CScript File Write With Script Extensions to Temp or Startup Paths

Pivot detection · T1059.005 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-wscript-cscript-script-file-dropper-via-file-write-to-scripting-extensio-002bdb95

title: Windows WScript/CScript File Write With Script Extensions to Temp or Startup Paths
id: 6c1da4a1-a6f2-4755-9d47-0717d02aa700
related:
  - id: cea72823-df4d-4567-950c-0b579eaf0846
    type: derived
  - id: 002bdb95-0cf1-46a6-9e08-d38c128a6127
    type: derived
status: test
description: This rule flags file creation or writing events where WScript.exe or CScript.exe targets files with script-related extensions (.js, .jse, .vba, .vbe, .vbs, .wsf, .wsh). It focuses on common locations attackers use for staging or persistence, including Perflogs, ProgramData, Temp/Tmp, user and Windows temp directories, and Startup folders. The detection relies on Windows file event telemetry that includes the executing image path and the target filename, plus matching on both extension and specific directory substrings.
references:
  - WScript or CScript Dropper (cea72823-df4d-4567-950c-0b579eaf0846)
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_cscript_wscript_dropper.yml
author: Tim Shelton, Huntrule Team
date: 2022-01-10
modified: 2026-02-17
tags:
  - attack.execution
  - attack.t1059.005
  - attack.t1059.007
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
      - \wscript.exe
      - \cscript.exe
    TargetFilename|contains:
      - :\Perflogs\
      - :\ProgramData\
      - :\Temp\
      - :\Tmp\
      - :\Users\
      - :\Windows\Temp\
      - \AppData\Local\Temp
      - \AppData\Roaming\Temp
      - \Start Menu\Programs\Startup\
      - \Temporary Internet
    TargetFilename|endswith:
      - .js
      - .jse
      - .vba
      - .vbe
      - .vbs
      - .wsf
      - .wsh
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL