Sigma rule: Manual Execution of Script Inside of a Compressed File

Rule

Title

Manual Execution of Script Inside of a Compressed File

Status

test

Level

medium

Author

@kostastsale

Date

2023-02-15

Modified

2024-08-13

File

rules-threat-hunting/windows/process_creation/proc_creation_win_susp_script_exec_from_compressed_parent.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

This is a threat-hunting query to collect information related to the interactive execution of a script from inside a compressed file (zip/rar). Windows will automatically run the script using scripting interpreters such as wscript and cscript binaries.

From the query below, the child process is the script interpreter that will execute the script. The script extension is also a set of standard extensions that Windows OS recognizes. Selections 1-3 contain three different execution scenarios.
1. Compressed file opened using 7zip.
2. Compressed file opened using WinRar.
3. Compressed file opened using native windows File Explorer capabilities.

When the malicious script is double-clicked, it will be extracted to the respected directories as signified by the CommandLine on each of the three Selections. It will then be executed using the relevant script interpreter."

Log source

product

windows

category

process_creation

Detection

selection_parent_7zip:
    ParentImage|endswith: '\7z*.exe'
    CommandLine|contains: '\AppData\local\temp\7z*\'
selection_parent_winrar:
    ParentImage|endswith: '\winrar.exe'
    CommandLine|contains: '\AppData\local\temp\rar*\'
selection_parent_explorer:
    ParentImage|endswith: '\explorer.exe'
    CommandLine|contains:
        - '\AppData\local\temp\*.rar\'
        - '\AppData\local\temp\*.zip\'
selection_child:
    Image|endswith:
        - '\cscript.exe'
        - '\mshta.exe'
        - '\powershell.exe'
        - '\pwsh.exe'
        - '\wscript.exe'
    CommandLine|endswith:
        - '.hta'
        - '.js'
        - '.jse'
        - '.ps1'
        - '.vbe'
        - '.vbs'
        - '.wsf'
        - '.wsh'
condition: 1 of selection_parent_* and selection_child

False positives (as the rule lists them)

• Batch files may produce a lot of noise, as many applications appear to bundle them as part of their installation process. You should baseline your environment and generate a new query excluding the noisy and expected activity. Some false positives may come up depending on your environment. All results should be investigated thoroughly before filtering out results.

Tags

• attack.execution
• attack.t1059
• detection.threat-hunting

MITRE ATT&CK ids this rule names

• T1059

References

• https://app.any.run/tasks/25970bb5-f864-4e9e-9e1b-cc8ff9e6386a
• https://app.any.run/tasks/fa99cedc-9d2f-4115-a08e-291429ce3692

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-threat-hunting/windows/process_creation/proc_creation_win_susp_script_exec_from_compressed_parent.yml