Sigma rule: Cscript/Wscript Potentially Suspicious Child Process

Rule

Title

Cscript/Wscript Potentially Suspicious Child Process

Status

test

Level

medium

Author

Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86')

Date

2023-05-15

Modified

2024-01-02

File

rules/windows/process_creation/proc_creation_win_wscript_cscript_susp_child_processes.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects potentially suspicious child processes of Wscript/Cscript. These include processes such as rundll32 with uncommon exports or PowerShell spawning rundll32 or regsvr32.
Malware such as Pikabot and Qakbot were seen using similar techniques as well as many others.

Log source

product

windows

category

process_creation

Detection

selection_parent:
    ParentImage|endswith:
        - '\wscript.exe'
        - '\cscript.exe'
selection_cli_script_main:
    Image|endswith:
        - '\cmd.exe'
        - '\powershell.exe'
        - '\pwsh.exe'
# Note: Add other combinations that are suspicious
selection_cli_script_option_mshta:
    CommandLine|contains|all:
        - 'mshta'
        - 'http'
selection_cli_script_option_other:
    CommandLine|contains:
        - 'rundll32'
        - 'regsvr32'
        - 'msiexec'
selection_cli_standalone:
    Image|endswith: '\rundll32.exe'
filter_main_rundll32_known_exports:
    Image|endswith: '\rundll32.exe'
    CommandLine|contains:
        - 'UpdatePerUserSystemParameters'
        - 'PrintUIEntry'
        - 'ClearMyTracksByProcess'
condition: selection_parent and ( selection_cli_standalone or (selection_cli_script_main and 1 of selection_cli_script_option_*) ) and not 1 of filter_main_*

False positives (as the rule lists them)

• Some false positives might occur with admin or third party software scripts. Investigate and apply additional filters accordingly.

Tags

• attack.execution

References

• Internal Research
• https://github.com/pr0xylife/Pikabot/blob/fc58126127adf0f65e78f4eec59675523f48f086/Pikabot_30.10.2023.txt
• https://github.com/pr0xylife/Pikabot/blob/fc58126127adf0f65e78f4eec59675523f48f086/Pikabot_22.12.2023.txt

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_wscript_cscript_susp_child_processes.yml