Thomas Patzke
7602309138
* Converted (to generic sigma) rules * Converter outputs by default with indentation 4
34 lines
990 B
YAML
34 lines
990 B
YAML
title: WScript or CScript Dropper
|
|
status: experimental
|
|
description: Detects wscript/cscript executions of scripts located in user directories
|
|
author: Margaritis Dimitrios (idea), Florian Roth (rule)
|
|
logsource:
|
|
category: process_creation
|
|
product: windows
|
|
detection:
|
|
selection:
|
|
Image:
|
|
- '*\wscript.exe'
|
|
- '*\cscript.exe'
|
|
CommandLine:
|
|
- '* C:\Users\\*.jse *'
|
|
- '* C:\Users\\*.vbe *'
|
|
- '* C:\Users\\*.js *'
|
|
- '* C:\Users\\*.vba *'
|
|
- '* C:\Users\\*.vbs *'
|
|
- '* C:\ProgramData\\*.jse *'
|
|
- '* C:\ProgramData\\*.vbe *'
|
|
- '* C:\ProgramData\\*.js *'
|
|
- '* C:\ProgramData\\*.vba *'
|
|
- '* C:\ProgramData\\*.vbs *'
|
|
falsepositive:
|
|
ParentImage: '*\winzip*'
|
|
condition: selection and not falsepositive
|
|
fields:
|
|
- CommandLine
|
|
- ParentCommandLine
|
|
falsepositives:
|
|
- Winzip
|
|
- Other self-extractors
|
|
level: high
|