{"id":"T1059.005","name":"Visual Basic","url":"https://attack.mitre.org/techniques/T1059/005","tactics":["execution"],"platforms":["Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0076","stix_id":"x-mitre-detection-strategy--4a7f1bc4-4396-49e1-9c75-caa6ecd64047","name":"Behavioral Detection of Visual Basic Execution (VBS/VBA/VBScript)","url":"https://attack.mitre.org/detectionstrategies/DET0076","analytics":[{"id":"AN0209","stix_id":"x-mitre-analytic--0fe7a1db-759d-4d27-8ef1-a71509643594","name":"Analytic 0209","description":"Detects execution of VB-based scripts or macros (VBS/VBA/VBScript) through cscript.exe/wscript.exe, Office-based process chains, or HTA usage. Focuses on chained behavior: Office or HTML container spawns script host > script host spawns PowerShell, network connections, or process injection.","url":"https://attack.mitre.org/detectionstrategies/DET0076#AN0209","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=7","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"ParentProcess","description":"Microsoft Word/Excel or mshta.exe spawning wscript.exe/cscript.exe."},{"field":"UserContext","description":"Script execution by non-admin users or service accounts."},{"field":"TimeWindow","description":"Script execution outside normal business hours or patching cycle."},{"field":"PayloadEntropyThreshold","description":"High entropy indicative of obfuscation or encoding in the script."},{"field":"ModuleName","description":"Loading of vbscript.dll, scrrun.dll, or other scripting engine modules."}],"live":true,"detection_strategies":["DET0076"],"techniques":["T1059.005"]},{"id":"AN0210","stix_id":"x-mitre-analytic--668bc76f-04cc-4274-8a66-cfa00e83ef14","name":"Analytic 0210","description":"Detects embedded or emulated VBScript/VBA execution via Wine-based apps, Office for Mac abusing cross-platform .NET features, or macros dropped and invoked via AppleScript or third-party automation tools.","url":"https://attack.mitre.org/detectionstrategies/DET0076#AN0210","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"log stream --predicate 'eventMessage contains \"wscript\" OR \"vbs\"'","data_component":"DC0029","data_component_name":"Script Execution","log_source_slug":"macos-unifiedlog"},{"name":"macos:osquery","channel":"process_events","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-osquery"},{"name":"macos:syslog","channel":"system.log","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"macos-syslog"}],"mutable_elements":[{"field":"ScriptLocation","description":"Script run from ~/Downloads, ~/Library, or /tmp/"},{"field":"EmulationContext","description":"Wine or CrossOver launching legacy Windows scripting engines."},{"field":"UserContext","description":"VB execution from non-standard or shared users on endpoint."}],"live":true,"detection_strategies":["DET0076"],"techniques":["T1059.005"]},{"id":"AN0211","stix_id":"x-mitre-analytic--08318de4-1327-48ac-a686-403162d3891f","name":"Analytic 0211","description":"Detects abuse of Mono/.NET Core environments to execute VB-like scripts, often in environments with Office emulation or WINE. Focus is on rare invocations of scripting hosts like mono.exe or .NET shells, often seen in spam filtering or forensic labs with Office support.","url":"https://attack.mitre.org/detectionstrategies/DET0076#AN0211","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"linux:syslog","channel":"/var/log/syslog","data_component":"DC0029","data_component_name":"Script Execution","log_source_slug":"linux-syslog"}],"mutable_elements":[{"field":"InterpreterPath","description":"Mono/.NET Core binary location may differ per distro or Docker container."},{"field":"FileExtension","description":".vbs, .vb, or .vba run under non-standard interpreters."},{"field":"ExecContext","description":"Execution by low-privilege users or from /tmp/."}],"live":true,"detection_strategies":["DET0076"],"techniques":["T1059.005"]}],"live":true,"version":"1.0","techniques":["T1059.005"]}],"sigma_rules":[{"id":"002bdb95-0cf1-46a6-9e08-d38c128a6127","title":"WScript or CScript Dropper - File","author":"Tim Shelton","status":"test","level":"high","date":"2022-01-10","modified":"2026-02-17","description":"Detects a file ending in jse, vbe, js, vba, vbs, wsf, wsh written by cscript.exe or wscript.exe","references":["WScript or CScript Dropper (cea72823-df4d-4567-950c-0b579eaf0846)"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.execution","attack.t1059.005","attack.t1059.007"],"path":"rules/windows/file/file_event/file_event_win_cscript_wscript_dropper.yml","techniques":["T1059.005","T1059.007"],"cves":[]},{"id":"05c36dd6-79d6-4a9a-97da-3db20298ab2d","title":"XSL Script Execution Via WMIC.EXE","author":"Timur Zinniatullin, oscd.community, Swachchhanda Shrawan Poudel","status":"test","level":"medium","date":"2019-10-21","modified":"2026-01-24","description":"Detects the execution of WMIC with the \"format\" flag to potentially load local XSL files.\nAdversaries abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses.\nExtensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1220/T1220.md"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1047","attack.t1220","attack.execution","attack.t1059.005","attack.t1059.007"],"path":"rules/windows/process_creation/proc_creation_win_wmic_xsl_script_processing.yml","techniques":["T1047","T1220","T1059.005","T1059.007"],"cves":[]},{"id":"07aa184a-870d-413d-893a-157f317f6f58","title":"Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBS","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-02-08","modified":null,"description":"Detects execution of the built-in script located in \"C:\\Windows\\System32\\gatherNetworkInfo.vbs\". Which can be used to gather information about the target machine","references":["https://posts.slayerlabs.com/living-off-the-land/#gathernetworkinfovbs","https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.execution","attack.t1615","attack.t1059.005"],"path":"rules/windows/process_creation/proc_creation_win_susp_gather_network_info_execution.yml","techniques":["T1615","T1059.005"],"cves":[]},{"id":"0bcfabcb-7929-47f4-93d6-b33fb67d34d1","title":"Adwind RAT / JRAT File Artifact","author":"Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community","status":"test","level":"high","date":"2017-11-10","modified":"2022-12-02","description":"Detects javaw.exe in AppData folder as used by Adwind / JRAT","references":["https://www.hybrid-analysis.com/sample/ba86fa0d4b6af2db0656a88b1dd29f36fe362473ae8ad04255c4e52f214a541c?environmentId=100","https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.execution","attack.t1059.005","attack.t1059.007"],"path":"rules/windows/file/file_event/file_event_win_mal_adwind.yml","techniques":["T1059.005","T1059.007"],"cves":[]},{"id":"1e33157c-53b1-41ad-bbcc-780b80b58288","title":"WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript","author":"Michael Haag","status":"test","level":"medium","date":"2019-01-16","modified":"2026-02-17","description":"Detects script file execution (.js, .jse, .vba, .vbe, .vbs, .wsf, .wsh) by Wscript/Cscript.","references":["https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/","https://redcanary.com/blog/gootloader/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.005","attack.t1059.007","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_wscript_cscript_script_exec.yml","techniques":["T1059.005","T1059.007"],"cves":[]},{"id":"1fac1481-2dbc-48b2-9096-753c49b4ec71","title":"Adwind RAT / JRAT","author":"Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community","status":"test","level":"high","date":"2017-11-10","modified":"2022-10-09","description":"Detects javaw.exe in AppData folder as used by Adwind / JRAT","references":["https://www.hybrid-analysis.com/sample/ba86fa0d4b6af2db0656a88b1dd29f36fe362473ae8ad04255c4e52f214a541c?environmentId=100","https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.005","attack.t1059.007","detection.emerging-threats"],"path":"rules-emerging-threats/2017/Malware/Adwind-RAT/proc_creation_win_malware_adwind.yml","techniques":["T1059.005","T1059.007"],"cves":[]},{"id":"2a0a169d-cc66-43ce-9ae2-6e678e54e46a","title":"Registry Modification Attempt Via VBScript - PowerShell","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2025-08-13","modified":null,"description":"Detects attempts to modify the registry using VBScript's CreateObject(\"Wscript.shell\") and RegWrite methods embedded within PowerShell scripts or commands.\nThreat actors commonly embed VBScript code within PowerShell to perform registry modifications, attempting to evade detection that monitors for direct registry access through traditional tools.\nThis technique can be used for persistence, defense evasion, and privilege escalation by modifying registry keys without using regedit.exe, reg.exe, or PowerShell's native registry cmdlets.\n","references":["https://www.linkedin.com/posts/mauricefielenbach_livingofftheland-redteam-persistence-activity-7344801774182051843-TE00/","https://www.nextron-systems.com/2025/07/29/detecting-the-most-popular-mitre-persistence-method-registry-run-keys-startup-folder/","https://detect.fyi/hunting-fileless-malware-in-the-windows-registry-1339ccde00ad"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.persistence","attack.execution","attack.defense-impairment","attack.t1112","attack.t1059.005"],"path":"rules/windows/powershell/powershell_script/posh_ps_vbscript_registry_modification.yml","techniques":["T1112","T1059.005"],"cves":[]},{"id":"2e4e488a-6164-4811-9ea1-f960c7359c40","title":"HackTool - CACTUSTORCH Remote Thread Creation","author":"@SBousseaden (detection), Thomas Patzke (rule)","status":"test","level":"high","date":"2019-02-01","modified":"2023-05-05","description":"Detects remote thread creation from CACTUSTORCH as described in references.","references":["https://twitter.com/SBousseaden/status/1090588499517079552","https://github.com/mdsecactivebreach/CACTUSTORCH"],"logsource":{"product":"windows","category":"create_remote_thread"},"tags":["attack.privilege-escalation","attack.execution","attack.stealth","attack.t1055.012","attack.t1059.005","attack.t1059.007","attack.t1218.005"],"path":"rules/windows/create_remote_thread/create_remote_thread_win_hktl_cactustorch.yml","techniques":["T1055.012","T1059.005","T1059.007","T1218.005"],"cves":[]},{"id":"3a6586ad-127a-4d3b-a677-1e6eacdf8fde","title":"Windows Shell/Scripting Processes Spawning Suspicious Programs","author":"Florian Roth (Nextron Systems), Tim Shelton","status":"test","level":"high","date":"2018-04-06","modified":"2023-05-23","description":"Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, mshta...etc.","references":["https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.005","attack.t1059.001","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_susp_shell_spawn_susp_program.yml","techniques":["T1059.005","T1059.001","T1218"],"cves":[]},{"id":"401e5d00-b944-11ea-8f9a-00163ecd60ae","title":"AppLocker Prevented Application or Script from Running","author":"Pushkarev Dmitry","status":"test","level":"medium","date":"2020-06-28","modified":"2025-12-03","description":"Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.\n","references":["https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker","https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker","https://nxlog.co/documentation/nxlog-user-guide/applocker.html"],"logsource":{"product":"windows","service":"applocker"},"tags":["attack.execution","attack.t1204.002","attack.t1059.001","attack.t1059.003","attack.t1059.005","attack.t1059.006","attack.t1059.007"],"path":"rules/windows/builtin/applocker/win_applocker_application_was_prevented_from_running.yml","techniques":["T1204.002","T1059.001","T1059.003","T1059.005","T1059.006","T1059.007"],"cves":[]},{"id":"4fcac6eb-0287-4090-8eea-2602e4c20040","title":"Potential QBot Activity","author":"Florian Roth (Nextron Systems)","status":"stable","level":"critical","date":"2019-10-01","modified":"2023-02-03","description":"Detects potential QBot activity by looking for process executions used previously by QBot","references":["https://twitter.com/killamjr/status/1179034907932315648","https://app.any.run/tasks/2e0647b7-eb86-4f72-904b-d2d0ecac07d1/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.005","detection.emerging-threats"],"path":"rules-emerging-threats/2019/Malware/QBot/proc_creation_win_malware_qbot.yml","techniques":["T1059.005"],"cves":[]},{"id":"52cad028-0ff0-4854-8f67-d25dfcbc78b4","title":"HTML Help HH.EXE Suspicious Child Process","author":"Maxim Pavlunin, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2020-04-01","modified":"2023-04-12","description":"Detects a suspicious child process of a Microsoft HTML Help (HH.exe)","references":["https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/chm-badness-delivers-a-banking-trojan/","https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-27939090904026cc396b0b629c8e4314acd6f5dac40a676edbc87f4567b47eb7","https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/","https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.initial-access","attack.stealth","attack.t1047","attack.t1059.001","attack.t1059.003","attack.t1059.005","attack.t1059.007","attack.t1218","attack.t1218.001","attack.t1218.010","attack.t1218.011","attack.t1566","attack.t1566.001"],"path":"rules/windows/process_creation/proc_creation_win_hh_html_help_susp_child_process.yml","techniques":["T1047","T1059.001","T1059.003","T1059.005","T1059.007","T1218","T1218.001","T1218.010","T1218.011","T1566","T1566.001"],"cves":[]},{"id":"557e3bd3-7f21-495d-8d50-7c8bdfb8041c","title":"AppLocker Application Would Have Been Blocked","author":"heyyanu","status":"experimental","level":"medium","date":"2026-03-26","modified":null,"description":"Detects when AppLocker \"Audit only\" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker \"Enforce rules\" enforcement mode was enabled.\n","references":["https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker","https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker","https://www.splunk.com/en_us/blog/security/deploy-test-monitor-mastering-microsoft-applocker-part-2.html","https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/ee844150(v=ws.11)"],"logsource":{"product":"windows","service":"applocker"},"tags":["attack.execution","attack.t1204.002","attack.t1059.001","attack.t1059.003","attack.t1059.005","attack.t1059.006","attack.t1059.007"],"path":"rules/windows/builtin/applocker/win_applocker_application_would_have_been_blocked.yml","techniques":["T1204.002","T1059.001","T1059.003","T1059.005","T1059.006","T1059.007"],"cves":[]},{"id":"575dce0c-8139-4e30-9295-1ee75969f7fe","title":"Potential Reconnaissance Activity Via GatherNetworkInfo.VBS","author":"blueteamer8699","status":"test","level":"medium","date":"2022-01-03","modified":"2023-02-08","description":"Detects execution of the built-in script located in \"C:\\Windows\\System32\\gatherNetworkInfo.vbs\". Which can be used to gather information about the target machine","references":["https://posts.slayerlabs.com/living-off-the-land/#gathernetworkinfovbs","https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.execution","attack.t1615","attack.t1059.005"],"path":"rules/windows/process_creation/proc_creation_win_lolbin_gather_network_info.yml","techniques":["T1615","T1059.005"],"cves":[]},{"id":"5cddf373-ef00-4112-ad72-960ac29bac34","title":"HackTool - Koadic Execution","author":"wagga, Jonhnathan Ribeiro, oscd.community","status":"test","level":"high","date":"2020-01-12","modified":"2023-02-11","description":"Detects command line parameters used by Koadic hack tool","references":["https://unit42.paloaltonetworks.com/unit42-sofacy-groups-parallel-attacks/","https://github.com/offsecginger/koadic/blob/457f9a3ff394c989cdb4c599ab90eb34fb2c762c/data/stager/js/stdlib.js","https://blog.f-secure.com/hunting-for-koadic-a-com-based-rootkit/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.003","attack.t1059.005","attack.t1059.007"],"path":"rules/windows/process_creation/proc_creation_win_hktl_koadic.yml","techniques":["T1059.003","T1059.005","T1059.007"],"cves":[]},{"id":"7f4c43f9-b1a5-4c7d-b24a-b41bf3a3ebf2","title":"Registry Tampering by Potentially Suspicious Processes","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2025-08-13","modified":"2026-04-14","description":"Detects suspicious registry modifications made by suspicious processes such as script engine processes such as WScript, or CScript etc.\nThese processes are rarely used for legitimate registry modifications, and their activity may indicate an attempt to modify the registry\nwithout using standard tools like regedit.exe or reg.exe, potentially for evasion and persistence.\n","references":["https://www.nextron-systems.com/2025/07/29/detecting-the-most-popular-mitre-persistence-method-registry-run-keys-startup-folder/","https://www.linkedin.com/posts/mauricefielenbach_livingofftheland-redteam-persistence-activity-7344801774182051843-TE00/"],"logsource":{"product":"windows","category":"registry_event"},"tags":["attack.persistence","attack.execution","attack.defense-impairment","attack.t1112","attack.t1059.005"],"path":"rules/windows/registry/registry_event/registry_event_susp_process_registry_modification.yml","techniques":["T1112","T1059.005"],"cves":[]},{"id":"811f459f-9231-45d4-959a-0266c6311987","title":"Suspicious Child Process Of BgInfo.EXE","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-08-16","modified":null,"description":"Detects suspicious child processes of \"BgInfo.exe\" which could be a sign of potential abuse of the binary to proxy execution via external VBScript","references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/Bginfo/","https://oddvar.moe/2017/05/18/bypassing-application-whitelisting-with-bginfo/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.005","attack.t1218","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_bginfo_suspicious_child_process.yml","techniques":["T1059.005","T1218","T1202"],"cves":[]},{"id":"8d63dadf-b91b-4187-87b6-34a1114577ea","title":"Potential Remote SquiblyTwo Technique Execution","author":"Markus Neis, Florian Roth, Swachchhanda Shrawan Poudel (Nextron Systems)","status":"test","level":"high","date":"2019-01-16","modified":"2026-01-24","description":"Detects potential execution of the SquiblyTwo technique that leverages Windows Management Instrumentation (WMI)\nto execute malicious code remotely. This technique bypasses application whitelisting by using wmic.exe to process\nmalicious XSL (eXtensible Stylesheet Language) scripts that can contain embedded JScript or VBScript.\nThe attack typically works by fetching XSL content from a remote source (using HTTP/HTTPS) and executing it\nwith full trust privileges directly in memory, avoiding disk-based detection mechanisms. This is a common\nLOLBin (Living Off The Land Binary) technique used for defense evasion and code execution.\n","references":["https://web.archive.org/web/20190209154607/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html","https://twitter.com/mattifestation/status/986280382042595328","https://atomicredteam.io/defense-evasion/T1220/","https://lolbas-project.github.io/lolbas/Binaries/Wmic/","https://x.com/byrne_emmy12099/status/1932346420226658668"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1047","attack.t1220","attack.execution","attack.t1059.005","attack.t1059.007"],"path":"rules/windows/process_creation/proc_creation_win_wmic_squiblytwo_bypass.yml","techniques":["T1047","T1220","T1059.005","T1059.007"],"cves":[]},{"id":"921aa10f-2e74-4cca-9498-98f9ca4d6fdf","title":"Registry Modification Attempt Via VBScript","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2025-08-13","modified":null,"description":"Detects attempts to modify the registry using VBScript's CreateObject(\"Wscript.shell\") and RegWrite methods via common LOLBINs.\nIt could be an attempt to modify the registry for persistence without using straightforward methods like regedit.exe, reg.exe, or PowerShell.\nThreat Actors may use this technique to evade detection by security solutions that monitor for direct registry modifications through traditional tools.\n","references":["https://www.linkedin.com/posts/mauricefielenbach_livingofftheland-redteam-persistence-activity-7344801774182051843-TE00/","https://www.nextron-systems.com/2025/07/29/detecting-the-most-popular-mitre-persistence-method-registry-run-keys-startup-folder/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.execution","attack.defense-impairment","attack.t1112","attack.t1059.005"],"path":"rules/windows/process_creation/proc_creation_win_vbscript_registry_modification.yml","techniques":["T1112","T1059.005"],"cves":[]},{"id":"966e4016-627f-44f7-8341-f394905c361f","title":"Potential APT10 Cloud Hopper Activity","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2017-04-07","modified":"2023-03-08","description":"Detects potential process and execution activity related to APT10 Cloud Hopper operation","references":["https://web.archive.org/web/20180725233601/https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.g0045","attack.t1059.005","detection.emerging-threats"],"path":"rules-emerging-threats/2017/TA/APT10/proc_creation_win_apt_apt10_cloud_hopper.yml","techniques":["T1059.005"],"cves":[]},{"id":"99b7460d-c9f1-40d7-a316-1f36f61d52ee","title":"Cscript/Wscript Uncommon Script Extension Execution","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-05-15","modified":"2023-06-19","description":"Detects Wscript/Cscript executing a file with an uncommon (i.e. non-script) extension","references":["Internal Research"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.005","attack.t1059.007"],"path":"rules/windows/process_creation/proc_creation_win_wscript_cscript_uncommon_extension_exec.yml","techniques":["T1059.005","T1059.007"],"cves":[]},{"id":"a9c73e8b-3b2d-4c45-8ef2-5f9a9c9998ad","title":"MMC Loading Script Engines DLLs","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2025-02-05","modified":null,"description":"Detects when the Microsoft Management Console (MMC) loads the DLL libraries like vbscript, jscript etc which might indicate an attempt\nto execute malicious scripts within a trusted system process for bypassing application whitelisting or defense evasion.\n","references":["https://tria.ge/241015-l98snsyeje/behavioral2","https://www.elastic.co/security-labs/grimresource"],"logsource":{"product":"windows","category":"image_load"},"tags":["attack.execution","attack.stealth","attack.t1059.005","attack.t1218.014"],"path":"rules/windows/image_load/image_load_win_mmc_loads_script_engine_dll.yml","techniques":["T1059.005","T1218.014"],"cves":[]},{"id":"aaf46cdc-934e-4284-b329-34aa701e3771","title":"Uncommon Child Process Of BgInfo.EXE","author":"Nasreddine Bencherchali (Nextron Systems), Beyu Denis, oscd.community","status":"test","level":"medium","date":"2019-10-26","modified":"2023-08-16","description":"Detects uncommon child processes of \"BgInfo.exe\" which could be a sign of potential abuse of the binary to proxy execution via external VBScript","references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/Bginfo/","https://oddvar.moe/2017/05/18/bypassing-application-whitelisting-with-bginfo/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.005","attack.t1218","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_bginfo_uncommon_child_process.yml","techniques":["T1059.005","T1218","T1202"],"cves":[]},{"id":"b730a276-6b63-41b8-bcf8-55930c8fc6ee","title":"Csc.EXE Execution Form Potentially Suspicious Parent","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)","status":"test","level":"high","date":"2019-02-11","modified":"2026-03-23","description":"Detects a potentially suspicious parent of \"csc.exe\", which could be a sign of payload delivery.","references":["https://www.uptycs.com/blog/warzonerat-can-now-evade-with-process-hollowing","https://reaqta.com/2017/11/short-journey-darkvnc/","https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.005","attack.t1059.007","attack.t1218.005","attack.t1027.004"],"path":"rules/windows/process_creation/proc_creation_win_csc_susp_parent.yml","techniques":["T1059.005","T1059.007","T1218.005","T1027.004"],"cves":[]},{"id":"cea72823-df4d-4567-950c-0b579eaf0846","title":"Potential Dropper Script Execution Via WScript/CScript/MSHTA","author":"Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community, Nasreddine Bencherchali (Nextron Systems), Dave Johnson","status":"test","level":"medium","date":"2019-01-16","modified":"2026-02-17","description":"Detects wscript/cscript/mshta executions of scripts located in user directories","references":["https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/","https://redcanary.com/blog/gootloader/","https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.005","attack.t1059.007"],"path":"rules/windows/process_creation/proc_creation_win_wscript_cscript_mshta_dropper.yml","techniques":["T1059.005","T1059.007"],"cves":[]},{"id":"e8a95b5e-c891-46e2-b33a-93937d3abc31","title":"Suspicious HH.EXE Execution","author":"Maxim Pavlunin","status":"test","level":"high","date":"2020-04-01","modified":"2023-04-12","description":"Detects a suspicious execution of a Microsoft HTML Help (HH.exe)","references":["https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/chm-badness-delivers-a-banking-trojan/","https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-27939090904026cc396b0b629c8e4314acd6f5dac40a676edbc87f4567b47eb7","https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/","https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.initial-access","attack.stealth","attack.t1047","attack.t1059.001","attack.t1059.003","attack.t1059.005","attack.t1059.007","attack.t1218","attack.t1218.001","attack.t1218.010","attack.t1218.011","attack.t1566","attack.t1566.001"],"path":"rules/windows/process_creation/proc_creation_win_hh_susp_execution.yml","techniques":["T1047","T1059.001","T1059.003","T1059.005","T1059.007","T1218","T1218.001","T1218.010","T1218.011","T1566","T1566.001"],"cves":[]},{"id":"efc21479-9e83-41da-8cf1-122e06ba8db3","title":"HackTool - NetExec File Indicators","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2026-04-08","modified":null,"description":"Detects file creation events indicating NetExec (nxc.exe) execution on the local machine.\nNetExec is a PyInstaller-bundled binary that extracts its embedded data files to a \"_MEI<random>\" directory\nunder the Temp folder upon execution. Files dropped under the \"\\nxc\\\" sub-directory of that\nextraction path are unique to NetExec and serve as reliable on-disk indicators of execution.\nNetExec (formerly CrackMapExec) is a widely used post-exploitation and lateral movement tool used for\nActive Directory enumeration, credential harvesting, and remote code execution.\n","references":["https://github.com/Pennyw0rth/NetExec","https://www.netexec.wiki/"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.execution","attack.lateral-movement","attack.discovery","attack.t1021.002","attack.t1059.005"],"path":"rules/windows/file/file_event/file_event_win_hktl_netexec_file_indicators.yml","techniques":["T1021.002","T1059.005"],"cves":[]},{"id":"f6c27ecc-d890-4452-80e6-2e274a10e097","title":"Axios NPM Compromise Indicators - Windows","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2026-04-01","modified":null,"description":"Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise.\nOn March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.\nThe dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection.\nThe attack used cscript.exe (VBScript), curl.exe (C2), and PowerShell masquerading as Windows Terminal.\n","references":["https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan","https://thehackernews.com/2026/03/axios-supply-chain-attack-pushes-cross.html?m=1","https://www.derp.ca/research/axios-npm-supply-chain-rat/","https://www.elastic.co/security-labs/axios-supply-chain-compromise-detections","https://www.virustotal.com/gui/file/e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.initial-access","attack.t1195.002","attack.execution","attack.command-and-control","attack.t1059.003","attack.t1059.005","attack.t1105","detection.emerging-threats"],"path":"rules-emerging-threats/2026/Malware/Axios-NPM-Compromise/proc_creation_win_axios_npm_compromise_indicators.yml","techniques":["T1195.002","T1059.003","T1059.005","T1105"],"cves":[]},{"id":"fe21810c-2a8c-478f-8dd3-5a287fb2a0e0","title":"Suspicious Scripting in a WMI Consumer","author":"Florian Roth (Nextron Systems), Jonhnathan Ribeiro","status":"test","level":"high","date":"2019-04-15","modified":"2023-09-09","description":"Detects suspicious commands that are related to scripting/powershell in WMI Event Consumers","references":["https://in.security/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/","https://github.com/Neo23x0/signature-base/blob/615bf1f6bac3c1bdc417025c40c073e6c2771a76/yara/gen_susp_lnk_files.yar#L19","https://github.com/RiccardoAncarani/LiquidSnake"],"logsource":{"product":"windows","category":"wmi_event"},"tags":["attack.execution","attack.t1059.005"],"path":"rules/windows/wmi_event/sysmon_wmi_susp_scripting.yml","techniques":["T1059.005"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}