Sigma rule: DNS Request From Windows Script Host

Rule

Title

DNS Request From Windows Script Host

Status

test

Level

low

Author

Josh Nickels, Marius Rothenbücher

Date

2024-09-06

File

rules-placeholder/windows/dns_query/dns_query_win_wscript_cscript_resolution.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects unusual domain resolutions originating from CScript/WScript that can identify malicious javascript files executing in an environment, often as a result from a phishing or watering hole attack.

Log source

product

windows

category

dns_query

Detection

selection:
    Image|endswith:
        - '\wscript.exe'
        - '\cscript.exe'
    QueryName|contains: '.' # Ensures that lookups are for external hosts
filter_main_internal_domains: # Populate this placeholder with known and expected internal domains
    QueryName|expand: '%internal_domains%'
filter_optional_trusted_domains: # Mostly certificate distribution domains
    - QueryName:
          - 'crl.starfieldtech.com'
          - 'ocsp.usertrust.com'
          - 'officecdn.microsoft.com'
          - 'oneocsp.microsoft.com'
          - 'oscp.comodoca.com'
          - 'oscp.sectigo.com'
          - 'oscp.starfieldtech.com'
          - 'www.python.org'
    - QueryName|endswith:
          - '.digicert.com'
          - '.entrust.net'
          - '.globalsign.net'
          - '.verisign.com'
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Script files making expected domain requests

Tags

• attack.execution
• attack.t1059

MITRE ATT&CK ids this rule names

• T1059

References

• Internal Research

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-placeholder/windows/dns_query/dns_query_win_wscript_cscript_resolution.yml