blue-team-tools/rules/windows/sysmon/sysmon_malware_script_dropper.yml

title: WScript or CScript Dropper
status: experimental
description: Detects wscript/cscript executions of scripts located in user directories
author: Margaritis Dimitrios (idea), Florian Roth (rule)
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 1
        Image:
            - '*\wscript.exe'
            - '*\cscript.exe'
        CommandLine:
            - '* C:\Users\\*.jse *'
            - '* C:\Users\\*.vbe *'
            - '* C:\Users\\*.js *'
            - '* C:\Users\\*.vba *'
            - '* C:\Users\\*.vbs *'
            - '* C:\ProgramData\\*.jse *'
            - '* C:\ProgramData\\*.vbe *'
            - '* C:\ProgramData\\*.js *'
            - '* C:\ProgramData\\*.vba *'
            - '* C:\ProgramData\\*.vbs *'
    falsepositive:
        ParentImage: '*\winzip*'
    condition: selection
fields:
    - CommandLine
    - ParentCommandLine
falsepositives:
    - Winzip
    - Other self-extractors
level: high