WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

A Sigma rule for process creation on Windows, from SigmaHQ’s threat hunting rules, by Michael Haag.

medium 2 ATT&CK techniques 2 programs it names 18 everyday examples trip it

What it looks for

its detection, as SigmaHQ writes it

detection:
  selection_cli:
    CommandLine|contains:
      - '.js'
      - '.jse'
      - '.vba'
      - '.vbe'
      - '.vbs'
      - '.wsf'
      - '.wsh'
  selection_img:
    - OriginalFileName:
        - 'wscript.exe'
        - 'cscript.exe'
    - Image|endswith:
        - '\wscript.exe'
        - '\cscript.exe'
  condition: all of selection_*

The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Michael Haag, under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.

Command lines that trip it

everyday examples from tldr-pages, CC BY 4.0, each read by CmdID

Run a script on the page for cscript.exe

cscript path\to\script.vbsIdentify

Run script in the interactive or batch mode (enable or suppress alerts, prompts, and scripting errors) on the page for cscript.exe

cscript //i path\to\script.vbsIdentify

Run a script on the page for wscript.exe

wscript path\to\script.vbsIdentify

Run script in the interactive or batch mode (enable or suppress alerts, prompts, and scripting errors) on the page for wscript.exe

wscript //i path\to\script.vbsIdentify

Install a product key (Note: It replaces the existing key) on the page for ospp.vbs

cscript ospp.vbs /inpkey:product_keyIdentify

Uninstall an installed product key with the last five digits of the product key on the page for ospp.vbs

cscript ospp.vbs /unpkey:product_key_digitsIdentify

Set a KMS host name on the page for ospp.vbs

cscript ospp.vbs /sethst:ipIdentify

Set a KMS port on the page for ospp.vbs

cscript ospp.vbs /setprt:portIdentify

Activate installed Office product keys on the page for ospp.vbs

cscript ospp.vbs /actIdentify

Display license information for installed product keys on the page for ospp.vbs

cscript ospp.vbs /dstatusIdentify

display the current Windows license information on the page for slmgr.vbs

cscript slmgr.vbs /dliIdentify

display the installation iD for the current device. Useful for offline license activation on the page for slmgr.vbs

cscript slmgr.vbs /dtiIdentify

And 6 more examples on CmdID’s program pages.

The commands documented for cscript.exe, manage-bde.wsf, winrm.vbs, wscript.exe trip it too: each is on its program’s page, read by CmdID.

Programs and files it names

their pages here

cscript.exewscript.exe

ATT&CK

the techniques it is tagged with

T1059.005Command and Scripting Interpreter: Visual Basic

T1059.007Command and Scripting Interpreter: JavaScript

WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

What it looks for

Command lines that trip it

Programs and files it names

ATT&CK

Other rules for T1059.005 Command and Scripting Interpreter: Visual Basic