title: GatherNetworkInfo.vbs Script Usage
id: 575dce0c-8139-4e30-9295-1ee75969f7fe
description: Adversaries can abuse of C:\Windows\System32\gatherNetworkInfo.vbs script along with cscript.exe to gather information about the target
status: experimental
references:
    - https://posts.slayerlabs.com/living-off-the-land/#gathernetworkinfovbs 
author: blueteamer8699
date: 2022/01/03
tags:
    - attack.discovery
    - attack.group_policy_discovery
    - attack.execution
    - attack.command_and_scripting_interpreter
    - attack.visual_basic
    - attack.t1059.005
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains|all: 
            - 'cscript.exe'
            - 'gatherNetworkInfo.vbs'
    condition: selection
falsepositives:
    - Administrative activity
fields:
    - CommandLine
    - ParentImage
level: medium
