Windows wscript.exe DNS Queries to Potentially Malicious Hex-Label Domains
Alerts when wscript.exe triggers DNS lookups for domains matching a C2-like regex pattern.
- Product
- windows
- Category
- dns_query
- Author
- Dusty Miller (SigmaHQ), DRL 1.1
- Published
- 2023-02-23
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags DNS queries on Windows where the initiating process is wscript.exe and the queried domain matches a specific hex-label pattern. Such scripted execution often appears in attacker tradecraft for secondary communication stages, where malware pulls instructions or configuration via DNS. The detection relies on DNS query telemetry that includes the process image path and the queried domain name, plus pattern matching against the expected domain format.
Reporting behind it
- virustotal.comhttps://www.virustotal.com/gui/file/0e2854753d17b1bb534de8e765d5813c9fb584a745978b3d92bc6ca78e3e7735/relations
- virustotal.comhttps://www.virustotal.com/gui/file/d5661009c461a8b20e1ad22f48609cc84dd90aee9182e026659dde4d46aaf25e/relations
- proofpoint.comhttps://www.proofpoint.com/us/blog/threat-insight/part-1-socgholish-very-real-threat-very-fake-update
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/dns_query_win_malware_socgholish_second_stage_c2.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows wscript.exe DNS Queries to Potentially Malicious Hex-Label Domains
id: 84461ae5-2dff-452b-83d1-98c6fdcb430d
status: test
description: This rule flags DNS queries on Windows where the initiating process is wscript.exe and the queried domain matches a specific hex-label pattern. Such scripted execution often appears in attacker tradecraft for secondary communication stages, where malware pulls instructions or configuration via DNS. The detection relies on DNS query telemetry that includes the process image path and the queried domain name, plus pattern matching against the expected domain format.
references:
- https://www.virustotal.com/gui/file/0e2854753d17b1bb534de8e765d5813c9fb584a745978b3d92bc6ca78e3e7735/relations
- https://www.virustotal.com/gui/file/d5661009c461a8b20e1ad22f48609cc84dd90aee9182e026659dde4d46aaf25e/relations
- https://www.proofpoint.com/us/blog/threat-insight/part-1-socgholish-very-real-threat-very-fake-update
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/dns_query_win_malware_socgholish_second_stage_c2.yml
author: Dusty Miller, Huntrule Team
date: 2023-02-23
tags:
- attack.command-and-control
- attack.t1219.002
- detection.emerging-threats
logsource:
product: windows
category: dns_query
detection:
selection:
Image|endswith: \wscript.exe
QueryName|re: "[a-f0-9]{4,8}\\.(?:[a-z0-9\\-]+\\.){2}[a-z0-9\\-]+"
condition: selection
falsepositives:
- Legitimate domain names matching the regex pattern by chance (e.g. domain controllers dc01.company.co.uk)
level: high
license: DRL-1.1
related:
- id: 70761fe8-6aa2-4f80-98c1-a57049c08e66
type: derived