Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionmediumtest

Wscript Shell Run In CommandLine

Detects the presence of the keywords "Wscript", "Shell" and "Run" in the command, which could indicate a suspicious activity

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Nasreddine Bencherchali (Nextron Systems)Created Wed Aug 31Updated Mon May 152c28c248-7f50-417a-9186-a85b223010eewindows
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic
Detection Logic1 selector
detection:
    selection:
        CommandLine|contains|all:
            - 'Wscript.'
            - '.Shell'
            - '.Run'
    condition: selection
False Positives

Inline scripting can be used by some rare third party applications or administrators. Investigate and apply additional filters accordingly

References
1
Resolving title…
web.archive.org
2
Resolving title…
blog.talosintelligence.com
MITRE ATT&CK
Rule Metadata
Rule ID
2c28c248-7f50-417a-9186-a85b223010ee
Status
test
Level
medium
Type
Detection
Created
Wed Aug 31
Modified
Mon May 15
Author
Nasreddine Bencherchali (Nextron Systems)
Path
rules/windows/process_creation/proc_creation_win_mshta_inline_vbscript.yml
Raw Tags
attack.executionattack.t1059
View on GitHub