rules/windows/process_creation/proc_creation_win_apt_cloudhopper.yml

title: WMIExec VBS Script
id: 966e4016-627f-44f7-8341-f394905c361f
status: test
description: Detects suspicious file execution by wscript and cscript
author: Florian Roth
references:
  - https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf
date: 2017/04/07
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\cscript.exe'
    CommandLine|contains|all:
      - '.vbs'
      - '/shell'
  condition: selection
fields:
  - CommandLine
  - ParentCommandLine
falsepositives:
  - Unlikely
level: critical
tags:
  - attack.execution
  - attack.g0045
  - attack.t1059.005
Massive Title Cleanup 2018-01-27 10:57:30 +01:00			`title: WMIExec VBS Script`
Added UUIDs to rules 2019-11-12 23:12:27 +01:00			`id: 966e4016-627f-44f7-8341-f394905c361f`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`status: test`
Rule: Cloud Hopper WmiExec VBS 2017-04-07 17:41:53 +02:00			`description: Detects suspicious file execution by wscript and cscript`
			`author: Florian Roth`
Change All "str" references to be "list"to mach schema update 2018-01-28 02:24:16 +03:00			`references:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`- https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf`
			`date: 2017/04/07`
			`modified: 2021/11/27`
Rule: Cloud Hopper WmiExec VBS 2017-04-07 17:41:53 +02:00			`logsource:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`category: process_creation`
			`product: windows`
Rule: Cloud Hopper WmiExec VBS 2017-04-07 17:41:53 +02:00			`detection:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`selection:`
			`Image\|endswith: '\cscript.exe'`
			`CommandLine\|contains\|all:`
			`- '.vbs'`
			`- '/shell'`
			`condition: selection`
Added field names to first rules 2017-09-12 23:54:04 +02:00			`fields:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`- CommandLine`
			`- ParentCommandLine`
Rule: Cloud Hopper WmiExec VBS 2017-04-07 17:41:53 +02:00			`falsepositives:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`- Unlikely`
Rule: Cloud Hopper WmiExec VBS 2017-04-07 17:41:53 +02:00			`level: critical`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`tags:`
			`- attack.execution`
			`- attack.g0045`
			`- attack.t1059.005`