Cscript/Wscript Uncommon Script Extension Execution

Title: Cscript/Wscript Uncommon Script Extension Execution
Status: test
Description:Detects Wscript/Cscript executing a file with an uncommon (i.e. non-script) extension
References:
  -Internal Research
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-15
modified:2023-06-19
Tags:

• -'attack.execution'
• -'attack.t1059.005'
• -'attack.t1059.007'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
    - OriginalFileName:
      - 'wscript.exe'
      - 'cscript.exe'
    - Image|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
  selection_extension:
    CommandLine|contains:
      -'.csv'
      -'.dat'
      -'.doc'
      -'.gif'
      -'.jpeg'
      -'.jpg'
      -'.png'
      -'.ppt'
      -'.txt'
      -'.xls'
      -'.xml'

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: high