Windows Wscript/Cscript Script-Interpreter Initiated Local Network Connection

title: Windows Wscript/Cscript Script-Interpreter Initiated Local Network Connection
id: 5c9efd33-faf7-4b1c-8770-9fba408d66f5
related:
  - id: 992a6cae-db6a-43c8-9cec-76d7195c96fc
    type: derived
  - id: 08249dc0-a28d-4555-8ba5-9255a198e08c
    type: derived
status: test
description: This rule identifies Windows script interpreters (wscript.exe or cscript.exe) that initiate a network connection to local or private network destinations (e.g., 10.0.0.0/8, 192.168.0.0/16, and loopback/link-local ranges). Attackers may use these interpreters to retrieve or stage scripts from shared folders, enabling execution outside typical application flows. It relies on Windows network connection telemetry that includes the initiating process image and the destination IP address, and matches only when the destination falls within the specified local/private IP ranges.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/28d190330fe44de6ff4767fc400cc10fa7cd6540/atomics/T1105/T1105.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_wscript_cscript_local_connection.yml
author: frack113, Huntrule Team
date: 2022-08-28
modified: 2024-05-31
tags:
  - attack.command-and-control
  - attack.t1105
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: "true"
    Image|endswith:
      - \wscript.exe
      - \cscript.exe
    DestinationIp|cidr:
      - 127.0.0.0/8
      - 10.0.0.0/8
      - 172.16.0.0/12
      - 192.168.0.0/16
      - 169.254.0.0/16
      - ::1/128
      - fe80::/10
      - fc00::/7
  condition: selection
falsepositives:
  - Legitimate scripts
level: medium
license: DRL-1.1