Sigma rule: Script Interpreter Execution From Suspicious Folder

Rule

Title

Script Interpreter Execution From Suspicious Folder

Status

test

Level

high

Author

Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

Date

2022-02-08

Modified

2026-02-17

File

rules/windows/process_creation/proc_creation_win_susp_script_exec_from_env_folder.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects suspicious script execution from suspicious directories or folders accessible by environment variables that may indicate malware activity.
Script interpreters (cscript, wscript, mshta, powershell) executing from folders like Temp, Public, or user profile directories may suggest attempts to evade detection or execute malicious scripts.

Log source

product

windows

category

process_creation

Detection

selection_proc_image:
    Image|endswith:
        - '\cscript.exe'
        - '\mshta.exe'
        - '\wscript.exe'
selection_proc_flags:
    CommandLine|contains:
        - ' -ep bypass '
        - ' -ExecutionPolicy bypass '
        - ' -w hidden '
        - '/e:javascript '
        - '/e:Jscript '
        - '/e:vbscript '
selection_proc_original:
    OriginalFileName:
        - 'cscript.exe'
        - 'mshta.exe'
        - 'wscript.exe'
selection_folders_1:
    CommandLine|contains:
        - ':\Perflogs\'
        - ':\Users\Public\'
        - '\%Public%'
        - '\AppData\Local\Temp'
        - '\AppData\Roaming\Temp'
        - '\Temporary Internet'
        - '\Windows\Temp'
        - '\Start Menu\Programs\Startup\'
        - '%TEMP%'
        - '%TMP%'
        - '%LocalAppData%\Temp'
selection_folders_2:
    - CommandLine|contains|all:
          - ':\Users\'
          - '\Favorites\'
    - CommandLine|contains|all:
          - ':\Users\'
          - '\Favourites\'
    - CommandLine|contains|all:
          - ':\Users\'
          - '\Contacts\'
    - CommandLine|contains|all:
          - ':\Users\'
          - '\Documents\'
    - CommandLine|contains|all:
          - ':\Users\'
          - '\Music\'
    - CommandLine|contains|all:
          - ':\Users\'
          - '\Pictures\'
    - CommandLine|contains|all:
          - ':\Users\'
          - '\Videos\'
filter_optional_chocolatey_installer:
    ParentImage:
        - 'C:\Windows\System32\Msiexec.exe'
        - 'C:\Windows\SysWOW64\Msiexec.exe'
    Image|endswith: '\powershell.exe'
    CommandLine|contains|all:
        - '-NoProfile -ExecutionPolicy Bypass -Command'
        - 'AppData\Local\Temp\'
        - 'Install-Chocolatey.ps1'
condition: 1 of selection_proc_* and 1 of selection_folders_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Various legitimate software have been observed to use similar techniques for installation or update purposes;thus, it is recommended to review and tune filters for your environment to reduce false positives before deploying to production.

Tags

• attack.execution
• attack.t1059

MITRE ATT&CK ids this rule names

• T1059

References

• https://www.virustotal.com/gui/file/91ba814a86ddedc7a9d546e26f912c541205b47a853d227756ab1334ade92c3f
• https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-russia-ukraine-military
• https://learn.microsoft.com/en-us/windows/win32/shell/csidl

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_susp_script_exec_from_env_folder.yml