Manual Execution of Script Inside of a Compressed File
This is a threat-hunting query to collect information related to the interactive execution of a script from inside a compressed file (zip/rar). Windows will automatically run the script using scripting interpreters such as wscript and cscript binaries. From the query below, the child process is the script interpreter that will execute the script. The script extension is also a set of standard extensions that Windows OS recognizes. Selections 1-3 contain three different execution scenarios. 1. Compressed file opened using 7zip. 2. Compressed file opened using WinRar. 3. Compressed file opened using native windows File Explorer capabilities. When the malicious script is double-clicked, it will be extracted to the respected directories as signified by the CommandLine on each of the three Selections. It will then be executed using the relevant script interpreter."
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.
detection:
selection_parent_7zip:
ParentImage|endswith: '\7z*.exe'
CommandLine|contains: '\AppData\local\temp\7z*\'
selection_parent_winrar:
ParentImage|endswith: '\winrar.exe'
CommandLine|contains: '\AppData\local\temp\rar*\'
selection_parent_explorer:
ParentImage|endswith: '\explorer.exe'
CommandLine|contains:
- '\AppData\local\temp\*.rar\'
- '\AppData\local\temp\*.zip\'
selection_child:
Image|endswith:
- '\cscript.exe'
- '\mshta.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\wscript.exe'
CommandLine|endswith:
- '.hta'
- '.js'
- '.jse'
- '.ps1'
- '.vbe'
- '.vbs'
- '.wsf'
- '.wsh'
condition: 1 of selection_parent_* and selection_childBatch files may produce a lot of noise, as many applications appear to bundle them as part of their installation process. You should baseline your environment and generate a new query excluding the noisy and expected activity. Some false positives may come up depending on your environment. All results should be investigated thoroughly before filtering out results.
Tactics
Other