Techniques › T1059 › T1059.005
T1059.005 Visual Basic
execution — Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
29
Sigma rules tagged attack.t1059.005
0
KEV CVEs mapped here
<p>Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows technologies such as Component Object Model and the Native API through the Windows API. Although tagged as legacy with no planned future evolutions, VB is integrated and supported in the .NET Framework and cross-platform .NET Core.</p><p>Derivative languages based on VB have also been created, such as Visual Basic for Applications (VBA) and VBScript. VBA is an event-driven programming language built into Microsoft Office, as well as several third-party applications. VBA enables documents to contain macros used to automate the execution of tasks and other functionality on the host. VBScript is a default scripting language on Windows hosts and can also be used in place of JavaScript on HTML Application (HTA) webpages served to Internet Explorer (though most modern browsers do not come with VBScript support).</p><p>Adversaries may use VB payloads to execute malicious commands. Common malicious usage includes automating execution of behaviors with VBScript or embedding VBA content into Spearphishing Attachment payloads (which may also involve Mark-of-the-Web Bypass to enable execution).</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0076 Behavioral Detection of Visual Basic Execution (VBS/VBA/VBScript) v1.0
AN0209 WindowsDetects execution of VB-based scripts or macros (VBS/VBA/VBScript) through cscript.exe/wscript.exe, Office-based process chains, or HTA usage. Focuses on chained behavior: Office or HTML container spawns script host > script host spawns PowerShell, network connections, or process injection.Tunable:
ParentProcessUserContextTimeWindowPayloadEntropyThresholdModuleNameAN0210 macOSDetects embedded or emulated VBScript/VBA execution via Wine-based apps, Office for Mac abusing cross-platform .NET features, or macros dropped and invoked via AppleScript or third-party automation tools.macos:unifiedloglog stream --predicate 'eventMessage contains "wscript" OR "vbs"'→ DC0029 Script ExecutionTunable:ScriptLocationEmulationContextUserContextAN0211 LinuxDetects abuse of Mono/.NET Core environments to execute VB-like scripts, often in environments with Office emulation or WINE. Focus is on rare invocations of scripting hosts like mono.exe or .NET shells, often seen in spam filtering or forensic labs with Office support.Tunable:InterpreterPathFileExtensionExecContext
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1059.005
Author: Tim Shelton
· 2022-01-10 (modified 2026-02-17) · logsource: product=windows category=file_event · 002bdb95-0cf1-46a6-9e08-d38c128a6127
Detects a file ending in jse, vbe, js, vba, vbs, wsf, wsh written by cscript.exe or wscript.exe
Author: Timur Zinniatullin, oscd.community, Swachchhanda Shrawan Poudel
· 2019-10-21 (modified 2026-01-24) · logsource: product=windows category=process_creation · 05c36dd6-79d6-4a9a-97da-3db20298ab2d
Detects the execution of WMIC with the "format" flag to potentially load local XSL files.
Adversaries abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses.
Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-02-08 · logsource: product=windows category=process_creation · 07aa184a-870d-413d-893a-157f317f6f58
Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine
Author: Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community
· 2017-11-10 (modified 2022-12-02) · logsource: product=windows category=file_event · 0bcfabcb-7929-47f4-93d6-b33fb67d34d1
Detects javaw.exe in AppData folder as used by Adwind / JRAT
Author: Michael Haag
· 2019-01-16 (modified 2026-02-17) · logsource: product=windows category=process_creation · 1e33157c-53b1-41ad-bbcc-780b80b58288
Detects script file execution (.js, .jse, .vba, .vbe, .vbs, .wsf, .wsh) by Wscript/Cscript.
Author: Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community
· 2017-11-10 (modified 2022-10-09) · logsource: product=windows category=process_creation · 1fac1481-2dbc-48b2-9096-753c49b4ec71
Detects javaw.exe in AppData folder as used by Adwind / JRAT
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-08-13 · logsource: product=windows category=ps_script · 2a0a169d-cc66-43ce-9ae2-6e678e54e46a
Detects attempts to modify the registry using VBScript's CreateObject("Wscript.shell") and RegWrite methods embedded within PowerShell scripts or commands.
Threat actors commonly embed VBScript code within PowerShell to perform registry modifications, attempting to evade detection that monitors for direct registry access through traditional tools.
This technique can be used for persistence, defense evasion, and privilege escalation by modifying registry keys without using regedit.exe, reg.exe, or PowerShell's native registry cmdlets.
Author: @SBousseaden (detection), Thomas Patzke (rule)
· 2019-02-01 (modified 2023-05-05) · logsource: product=windows category=create_remote_thread · 2e4e488a-6164-4811-9ea1-f960c7359c40
Detects remote thread creation from CACTUSTORCH as described in references.
Author: Florian Roth (Nextron Systems), Tim Shelton
· 2018-04-06 (modified 2023-05-23) · logsource: product=windows category=process_creation · 3a6586ad-127a-4d3b-a677-1e6eacdf8fde
Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, mshta...etc.
Author: Pushkarev Dmitry
· 2020-06-28 (modified 2025-12-03) · logsource: product=windows service=applocker · 401e5d00-b944-11ea-8f9a-00163ecd60ae
Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.
Author: Florian Roth (Nextron Systems)
· 2019-10-01 (modified 2023-02-03) · logsource: product=windows category=process_creation · 4fcac6eb-0287-4090-8eea-2602e4c20040
Detects potential QBot activity by looking for process executions used previously by QBot
Author: Maxim Pavlunin, Nasreddine Bencherchali (Nextron Systems)
· 2020-04-01 (modified 2023-04-12) · logsource: product=windows category=process_creation · 52cad028-0ff0-4854-8f67-d25dfcbc78b4
Detects a suspicious child process of a Microsoft HTML Help (HH.exe)
Author: heyyanu
· 2026-03-26 · logsource: product=windows service=applocker · 557e3bd3-7f21-495d-8d50-7c8bdfb8041c
Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.
Author: blueteamer8699
· 2022-01-03 (modified 2023-02-08) · logsource: product=windows category=process_creation · 575dce0c-8139-4e30-9295-1ee75969f7fe
Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine
Author: wagga, Jonhnathan Ribeiro, oscd.community
· 2020-01-12 (modified 2023-02-11) · logsource: product=windows category=process_creation · 5cddf373-ef00-4112-ad72-960ac29bac34
Detects command line parameters used by Koadic hack tool
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-08-13 (modified 2026-04-14) · logsource: product=windows category=registry_event · 7f4c43f9-b1a5-4c7d-b24a-b41bf3a3ebf2
Detects suspicious registry modifications made by suspicious processes such as script engine processes such as WScript, or CScript etc.
These processes are rarely used for legitimate registry modifications, and their activity may indicate an attempt to modify the registry
without using standard tools like regedit.exe or reg.exe, potentially for evasion and persistence.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-08-16 · logsource: product=windows category=process_creation · 811f459f-9231-45d4-959a-0266c6311987
Detects suspicious child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript
Author: Markus Neis, Florian Roth, Swachchhanda Shrawan Poudel (Nextron Systems)
· 2019-01-16 (modified 2026-01-24) · logsource: product=windows category=process_creation · 8d63dadf-b91b-4187-87b6-34a1114577ea
Detects potential execution of the SquiblyTwo technique that leverages Windows Management Instrumentation (WMI)
to execute malicious code remotely. This technique bypasses application whitelisting by using wmic.exe to process
malicious XSL (eXtensible Stylesheet Language) scripts that can contain embedded JScript or VBScript.
The attack typically works by fetching XSL content from a remote source (using HTTP/HTTPS) and executing it
with full trust privileges directly in memory, avoiding disk-based detection mechanisms. This is a common
LOLBin (Living Off The Land Binary) technique used for defense evasion and code execution.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-08-13 · logsource: product=windows category=process_creation · 921aa10f-2e74-4cca-9498-98f9ca4d6fdf
Detects attempts to modify the registry using VBScript's CreateObject("Wscript.shell") and RegWrite methods via common LOLBINs.
It could be an attempt to modify the registry for persistence without using straightforward methods like regedit.exe, reg.exe, or PowerShell.
Threat Actors may use this technique to evade detection by security solutions that monitor for direct registry modifications through traditional tools.
Author: Florian Roth (Nextron Systems)
· 2017-04-07 (modified 2023-03-08) · logsource: product=windows category=process_creation · 966e4016-627f-44f7-8341-f394905c361f
Detects potential process and execution activity related to APT10 Cloud Hopper operation
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-05-15 (modified 2023-06-19) · logsource: product=windows category=process_creation · 99b7460d-c9f1-40d7-a316-1f36f61d52ee
Detects Wscript/Cscript executing a file with an uncommon (i.e. non-script) extension
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-02-05 · logsource: product=windows category=image_load · a9c73e8b-3b2d-4c45-8ef2-5f9a9c9998ad
Detects when the Microsoft Management Console (MMC) loads the DLL libraries like vbscript, jscript etc which might indicate an attempt
to execute malicious scripts within a trusted system process for bypassing application whitelisting or defense evasion.
Author: Nasreddine Bencherchali (Nextron Systems), Beyu Denis, oscd.community
· 2019-10-26 (modified 2023-08-16) · logsource: product=windows category=process_creation · aaf46cdc-934e-4284-b329-34aa701e3771
Detects uncommon child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
· 2019-02-11 (modified 2026-03-23) · logsource: product=windows category=process_creation · b730a276-6b63-41b8-bcf8-55930c8fc6ee
Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.
Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community, Nasreddine Bencherchali (Nextron Systems), Dave Johnson
· 2019-01-16 (modified 2026-02-17) · logsource: product=windows category=process_creation · cea72823-df4d-4567-950c-0b579eaf0846
Detects wscript/cscript/mshta executions of scripts located in user directories
Author: Maxim Pavlunin
· 2020-04-01 (modified 2023-04-12) · logsource: product=windows category=process_creation · e8a95b5e-c891-46e2-b33a-93937d3abc31
Detects a suspicious execution of a Microsoft HTML Help (HH.exe)
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-04-08 · logsource: product=windows category=file_event · efc21479-9e83-41da-8cf1-122e06ba8db3
Detects file creation events indicating NetExec (nxc.exe) execution on the local machine.
NetExec is a PyInstaller-bundled binary that extracts its embedded data files to a "_MEI<random>" directory
under the Temp folder upon execution. Files dropped under the "\nxc\" sub-directory of that
extraction path are unique to NetExec and serve as reliable on-disk indicators of execution.
NetExec (formerly CrackMapExec) is a widely used post-exploitation and lateral movement tool used for
Active Directory enumeration, credential harvesting, and remote code execution.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-04-01 · logsource: product=windows category=process_creation · f6c27ecc-d890-4452-80e6-2e274a10e097
Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise.
On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.
The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection.
The attack used cscript.exe (VBScript), curl.exe (C2), and PowerShell masquerading as Windows Terminal.
Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro
· 2019-04-15 (modified 2023-09-09) · logsource: product=windows category=wmi_event · fe21810c-2a8c-478f-8dd3-5a287fb2a0e0
Detects suspicious commands that are related to scripting/powershell in WMI Event Consumers
Rules tagged at the parent level (attack.t1059) 95
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Sohan G (D4rkCiph3r)
· 2023-04-05 · logsource: product=macos category=process_creation · 0250638a-2b28-4541-86fc-ea4c558fa0c6
Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-04-17 · logsource: product=windows category=process_creation · 05ebafc8-7aa2-4bcd-a269-2aec93f9e842
Detects usage of winget to add new additional download sources
Author: Victor Sergeev, oscd.community
· 2020-10-09 (modified 2024-04-23) · logsource: product=windows category=process_creation · 06b401f4-107c-4ff9-947f-9ec1e7649f1e
Detects execution of "ftp.exe" script with the "-s" or "/s" flag and any child processes ran by "ftp.exe".
Author: Nasreddine Bencherchali (Nextron Systems), E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
· 2022-06-14 (modified 2023-01-04) · logsource: product=windows category=process_creation · 0955e4e1-c281-4fb9-9ee1-5ee7b4b754d2
Detects execition of commands and binaries from the context of The program compatibility assistant (Pcalua.exe). This can be used as a LOLBIN in order to bypass application whitelisting.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-25 · logsource: product=linux category=process_creation · 11bb9b26-4179-4a06-afcb-1ec31fce1627
Detects potential Shai-Hulud malware indicators based on specific command line arguments associated with its execution.
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2022-02-08 (modified 2026-02-17) · logsource: product=windows category=process_creation · 1228c958-e64e-4e71-92ad-7d429f4138ba
Detects suspicious script execution from suspicious directories or folders accessible by environment variables that may indicate malware activity.
Script interpreters (cscript, wscript, mshta, powershell) executing from folders like Temp, Public, or user profile directories may suggest attempts to evade detection or execute malicious scripts.
Author: Josh Nickels, Marius Rothenbücher
· 2024-09-06 · logsource: product=windows category=dns_query · 12310575-e8b1-475c-a976-57ed540b349c
Detects unusual domain resolutions originating from CScript/WScript that can identify malicious javascript files executing in an environment, often as a result from a phishing or watering hole attack.
Author: Florian Roth (Nextron Systems)
· 2021-11-20 (modified 2023-03-29) · logsource: product=windows category=file_event · 1277f594-a7d1-4f28-a2d3-73af5cbeab43
Detects Windows shells and scripting applications that write files to suspicious folders
Author: frack113, Tim Shelton (update fp)
· 2022-12-05 (modified 2025-03-06) · logsource: product=windows category=process_creation · 178e615d-e666-498b-9630-9ed363038101
Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a uncommon parent location.
Author: Micah Babinski
· 2023-10-15 · logsource: product=windows category=file_event · 1a433e1d-03d2-47a6-8063-ece992cf4e73
Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe.
This activity has been associated with DarkGate malware, which uses Autoit3.exe to execute shellcode that performs
process injection and connects to the DarkGate command-and-control server. Curl, KeyScramblerLogon, and these other
processes consitute non-standard and suspicious ways to retrieve the Autoit3 executable.
Author: Andreas Braathen (mnemonic.io)
· 2023-11-14 · logsource: product=windows category=process_creation · 1ddaa9a4-eb0b-4398-a9fe-7b018f9e23db
Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-01-02 · logsource: product=windows category=process_creation · 20a5ffa1-3848-4584-b6f8-c7c7fd9f69c8
Detects execution of ruby using the "-e" flag. This is could be used as a way to launch a reverse shell or execute live ruby code.
Author: Tim Rauch (rule), Elastic (idea)
· 2022-10-17 · logsource: product=macos category=process_creation · 234dc5df-40b5-49d1-bf53-0d44ce778eca
Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-06-14 · logsource: product=windows category=process_creation · 236d8e89-ed95-4789-a982-36f4643738ba
Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script that's located in a potentially suspicious location to run for a specific VM state
Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
· 2024-01-11 · logsource: product=windows category=process_creation · 2433a154-bb3d-42e4-86c3-a26bdac91c45
Detects the execution of a renamed "PingCastle" binary based on the PE metadata fields.
Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
· 2024-03-22 · logsource: product=windows category=process_creation · 24474469-bd80-46cc-9e08-9fbe81bfaaca
Detects the execution of a Word document via the WinWord Start Menu shortcut.
This behavior was observed being used by KamiKakaBot samples in order to initiate the 2nd stage of the infection.
Author: Florian Roth (Nextron Systems)
· 2017-05-31 (modified 2022-10-09) · logsource: product=windows service=security · 24549159-ac1b-479c-8175-d42aea947cae
This events that are generated when using the hacktool Ruler by Sensepost
Author: Bhabesh Raj
· 2021-09-08 (modified 2023-02-13) · logsource: product=windows category=process_creation · 245f92e3-c4da-45f1-9070-bc552e06db11
Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2021-26084
Author: Florian Roth (Nextron Systems), wagga
· 2020-12-23 (modified 2023-03-10) · logsource: product=windows category=process_creation · 24c4d154-05a4-4b99-b57d-9b977472443a
Detects different process execution behaviors as described in various threat reports on Lazarus group activity
Author: X__Junior (Nextron Systems)
· 2024-03-11 · logsource: product=windows category=process_creation · 264982dc-dbad-4dce-b707-1e0d3e0f73d9
Detects the execution of a renamed "NirCmd.exe" binary based on the PE metadata fields.
Author: Swachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali
· 2025-12-05 · logsource: product=windows category=process_creation · 271de298-cc0e-4842-acd8-079a0a99ea65
Detects suspicious child processes started by Node.js server processes on Windows, which may indicate exploitation of vulnerabilities like CVE-2025-55182 (React2Shell).
Attackers can abuse the Node.js 'child_process' module to run system commands or scripts using methods such as spawn(), exec(), execFile(), fork(), or execSync().
If execSync() or exec() is used in the exploit, the command line often shows a shell (e.g., cmd.exe /d /s /c ...) running a suspicious command unless other shells are explicitly invoked.
For other methods, the spawned process appears directly in the Image field unless a shell is explicitly used.
Author: Victor Sergeev, oscd.community
· 2020-10-09 (modified 2023-02-03) · logsource: product=windows category=process_creation · 277a4393-446c-449a-b0ed-7fdc7795244c
Detects the execution of a renamed "ftp.exe" binary based on the PE metadata fields
Author: Florian Roth
· 2025-01-18 · logsource: product=linux category=process_creation · 297241f3-8108-4b3a-8c15-2dda9f844594
Detects the execution of a shell as sub process of "rsync" without the expected command line flag "-e" being used, which could be an indication of exploitation as described in CVE-2024-12084. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-08-31 (modified 2023-05-15) · logsource: product=windows category=process_creation · 2c28c248-7f50-417a-9186-a85b223010ee
Detects the presence of the keywords "Wscript", "Shell" and "Run" in the command, which could indicate a suspicious activity
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
· 2024-09-02 · logsource: product=linux category=process_creation · 2d2f44ff-4611-4778-a8fc-323a0e9850cc
Detects execution of inline Python code via the "-c" in order to call the "system" function from the "os" library, and spawn a shell.
Author: Sreeman, Florian Roth (Nextron Systems), frack113
· 2020-04-21 (modified 2023-04-17) · logsource: product=windows category=process_creation · 313d6012-51a0-4d93-8dfc-de8553239e25
Detects usage of winget to install applications via manifest file. Adversaries can abuse winget to download payloads remotely and execute them.
The manifest option enables you to install an application by passing in a YAML file directly to the client.
Winget can be used to download and install exe, msi or msix files later.
Author: @kostastsale
· 2023-06-01 · logsource: product=windows category=process_creation · 39ac1fb0-07f1-474b-b97e-c5c0eace0d79
Detects the execution of "csc.exe" via "w3wp.exe" process. MOVEit affected hosts execute "csc.exe" via the "w3wp.exe" process to dynamically compile malicious DLL files.
MOVEit is affected by a critical vulnerability. Exploited hosts show evidence of dynamically compiling a DLL and writing it under C:\\Windows\\Microsoft\.NET\\Framework64\\v4\.0\.30319\\Temporary ASP\.NET Files\\root\\([a-z0-9]{5,12})\\([a-z0-9]{5,12})\\App_Web_[a-z0-9]{5,12}\.dll.
Hunting Opportunity
Events from IIS dynamically compiling binaries via the csc.exe on behalf of the MOVEit application, especially since May 27th should be investigated.
Author: Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)
· 2022-08-25 (modified 2023-03-05) · logsource: product=windows category=process_creation · 42333b2c-b425-441c-b70e-99404a17170f
Detects process activity patterns as seen being used by Sliver C2 framework implants
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
· 2024-09-02 · logsource: product=linux category=process_creation · 47b3bbd4-1bf7-48cc-84ab-995362aaa75a
Detects the use of the "git" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Author: Nextron Systems
· 2022-06-03 · logsource: product=windows category=process_creation · 480e7e51-e797-47e3-8d72-ebfce65b6d8d
Detects python spawning a pretty tty
Author: Tim Rauch, Elastic (idea)
· 2022-09-21 (modified 2023-12-05) · logsource: product=windows category=process_creation · 4b991083-3d0e-44ce-8fc4-b254025d8d4b
Detects suspicious parent process for cmd.exe
Author: @d4ns4n_
· 2023-04-24 · logsource: product=linux category=process_creation · 4e25af4b-246d-44ea-8563-e42aacab006b
Detects usage of "xterm" as a potential reverse shell tunnel
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-25 · logsource: product=windows category=process_creation · 540703fb-a874-4385-a9d6-7cd1bfab268c
Detects potential Shai-Hulud malware indicators based on specific command line arguments associated with its execution.
Author: Markus Neis, Nasreddine Bencherchali (Nextron Systems)
· 2018-12-27 (modified 2023-02-09) · logsource: product=windows category=process_creation · 55f0a3a1-846e-40eb-8273-677371b8d912
Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to run applications or execute macros
Author: bohops, Bhabesh Raj
· 2021-10-08 (modified 2023-07-25) · logsource: product=windows category=process_creation · 5687f942-867b-4578-ade7-1e341c46e99a
Detects suspicious child process creations of VMware Tools process which may indicate persistence setup
Author: Ján Trenčanský
· 2020-07-28 · logsource: product=windows service=windefend · 57b649ef-ff42-4fb0-8bf6-62da243a1708
Detects actions taken by Windows Defender malware detection engines
Author: Florian Roth (Nextron Systems)
· 2021-07-03 (modified 2022-05-20) · logsource: product=windows category=process_creation · 5de632bc-7fbd-4c8a-944a-fce55c59eae5
Detects process command line patterns and locations used by REvil group in Kaseya incident (can also match on other malware)
Author: Nasreddine Bencherchali (Nextron Systems), frack113
· 2023-11-23 (modified 2025-03-06) · logsource: product=windows category=process_creation · 61065c72-5d7d-44ef-bf41-6a36684b545f
Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges. Use this rule to hunt for potential suspicious processes.
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2022-02-25 (modified 2024-07-12) · logsource: product=windows category=process_creation · 69bd9b97-2be2-41b6-9816-fb08757a4d1a
Detects a potentially suspicious execution of a parent process located in the "\Users\Public" folder executing a child process containing references to shell or scripting binaries and commandlines.
Author: juju4
· 2019-01-16 (modified 2021-11-27) · logsource: product=windows category=process_creation · 6bba49bf-7f8c-47d6-a1bb-6b4dece4640e
Detects suspicious process related to rasdial.exe
Author: Tim Rauch (rule), Elastic (idea)
· 2022-10-21 (modified 2022-12-28) · logsource: product=macos category=process_creation · 6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4
Detects when the macOS Script Editor utility spawns an unusual child process.
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
· 2020-10-29 (modified 2022-10-09) · logsource: product=windows category=file_event · 6e90ae7a-7cd3-473f-a035-4ebb72d961da
Detects processes creating temp files related to PCRE.NET package
Author: Austin Songer
· 2021-09-21 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 72af37e2-ec32-47dc-992b-bc288a2708cb
Identifies when a new cloudshell is created inside of Azure portal.
Author: X__Junior (Nextron Systems)
· 2023-09-11 (modified 2023-10-12) · logsource: product=windows category=process_creation · 7530cd3d-7671-43e3-b209-976966f6ea48
Detects the execution of a renamed "CURL.exe" binary based on the PE metadata fields
Author: X__Junior (Nextron Systems)
· 2023-07-11 · logsource: product=windows category=image_load · 799a5f48-0ac1-4e0f-9152-71d137d48c2a
Detects potential DLL sideloading of DLLs that are known to be abused from suspicious locations
Author: pH-T (Nextron Systems)
· 2023-04-17 (modified 2024-11-23) · logsource: product=windows category=process_creation · 7a4d9232-92fc-404d-8ce1-4c92e7caf539
Detects Stracciatella which executes a Powershell runspace from within C# (aka SharpPick technique) with AMSI, ETW and Script Block Logging disabled based on PE metadata characteristics.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-06-14 · logsource: product=windows category=process_creation · 7aa4e81a-a65c-4e10-9f81-b200eb229d7d
Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script to run for a specific VM state
Author: @kostastsale
· 2023-07-16 · logsource: product=windows category=process_creation · 7aaa5739-12fc-41aa-b98b-23ec27d42bdf
Detects the redirection of Ursnif discovery commands as part of the initial execution of the malware.
Author: Nasreddine Bencherchali (Nextron Systems), Luc Génaux
· 2022-12-28 (modified 2026-06-05) · logsource: product=linux category=process_creation · 7ab8f73a-fcff-428b-84aa-6a5ff7877dea
Detects the use of "vim" and it's siblings commands to execute a shell or proxy commands.
Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Author: @d4ns4n_, Nasreddine Bencherchali (Nextron Systems)
· 2023-04-07 · logsource: product=linux category=process_creation · 7f734ed0-4f47-46c0-837f-6ee62505abd9
Detects execution of netcat with the "-e" flag followed by common shells. This could be a sign of a potential reverse shell setup.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-06-03 · logsource: product=linux category=process_creation · 7fb14105-530e-4e2e-8cfb-99f7d8700b66
Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2022-26134
Author: Rafal Piasecki
· 2022-08-10 (modified 2026-03-30) · logsource: product=linux service=auditd · 808146b2-9332-4d78-9416-d7e47012d83d
detects BPFDoor .lock and .pid files access in temporary file storage facility
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-06-16 · logsource: product=windows category=process_creation · 814c95cc-8192-4378-a70a-f1aafd877af1
Detects usage of OpenConsole binary as a LOLBIN to launch other binaries to bypass application Whitelisting
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-04-17 · logsource: product=windows category=process_creation · 81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2
Detects usage of winget to add a new insecure (http) download source.
Winget will not allow the addition of insecure sources, hence this could indicate potential suspicious activity (or typos)
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
· 2020-10-29 (modified 2022-10-09) · logsource: product=windows category=image_load · 84b0a8f3-680b-4096-a45b-e9a89221727c
Detects processes loading modules related to PCRE.NET package
Author: Florian Roth (Nextron Systems)
· 2022-03-24 (modified 2025-07-18) · logsource: product=windows category=process_creation · 85b0b087-eddf-4a2b-b033-d771fa2b9775
Detects PowerShell download and execution cradles.
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
· 2024-08-29 · logsource: product=linux category=process_creation · 8737b7f6-8df3-4bb7-b1da-06019b99b687
Detects the use of the "ssh" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Author: Florian Roth (Nextron Systems), @neonprimetime
· 2021-09-08 (modified 2023-02-04) · logsource: product=windows category=process_creation · 894397c6-da03-425c-a589-3d09e7d1f750
Detects potential exploitation of CVE-2021-40444 via suspicious process patterns seen in in-the-wild exploitations
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-01-02 (modified 2025-10-07) · logsource: product=windows category=process_creation · 899133d5-4d7c-4a7f-94ee-27355c879d90
Detects execution of python using the "-c" flag. This is could be used as a way to launch a reverse shell or execute live python code.
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
· 2024-09-02 · logsource: product=linux category=process_creation · 8c1a5675-cb85-452f-a298-b01b22a51856
Detects the execution of "awk" or it's sibling commands, to invoke a shell using the system() function.
This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.
Author: Micah Babinski
· 2025-11-25 · logsource: product=windows category=process_creation · 8e95e73e-ba02-4a87-b4d7-0929b8053038
Detects script interpreters, command-line tools, and similar suspicious child processes of ArcSOC.exe.
ArcSOC.exe is the process name which hosts ArcGIS Server REST services. If an attacker compromises an ArcGIS
Server system and uploads a malicious Server Object Extension (SOE), they can send crafted requests to the corresponding
service endpoint and remotely execute code from the ArcSOC.exe process.
Author: @kostastsale
· 2023-02-15 (modified 2024-08-13) · logsource: product=windows category=process_creation · 95724fc1-a258-4674-97db-a30351981c5a
This is a threat-hunting query to collect information related to the interactive execution of a script from inside a compressed file (zip/rar). Windows will automatically run the script using scripting interpreters such as wscript and cscript binaries.
From the query below, the child process is the script interpreter that will execute the script. The script extension is also a set of standard extensions that Windows OS recognizes. Selections 1-3 contain three different execution scenarios.
1. Compressed file opened using 7zip.
2. Compressed file opened using WinRar.
3. Compressed file opened using native windows File Explorer capabilities.
When the malicious script is double-clicked, it will be extracted to the respected directories as signified by the CommandLine on each of the three Selections. It will then be executed using the relevant script interpreter."
Author: Tim Rauch, Elastic, E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
· 2022-06-14 (modified 2024-03-05) · logsource: product=windows category=process_creation · 9aa5106d-bce3-4b13-86df-3a20f1d5cf0b
Detects the execution of "forfiles" with the "/c" flag.
While this is an expected behavior of the tool, it can be abused in order to proxy execution through it with any binary.
Can be used to bypass application whitelisting.
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
· 2022-02-15 (modified 2023-03-06) · logsource: product=windows category=process_creation · a77c1610-fc73-4019-8e29-0f51efc04a51
Detects possible payload obfuscation via the commandline
Author: Sreeman
· 2020-04-21 (modified 2022-03-08) · logsource: product=windows category=process_creation · ae9b0bd7-8888-4606-b444-0ed7410cb728
Monitors for the hiding possible malicious files in the C:\Windows\Fonts\ location. This folder doesn't require admin privillege to be written and executed from.
Author: X__Junior (Nextron Systems), Florian Roth (Nextron Systems)
· 2022-12-15 (modified 2024-01-02) · logsource: product=windows category=process_creation · afe52666-401e-4a02-b4ff-5d128990b8cb
Detects RAR usage that creates an archive from a suspicious folder, either a system folder or one of the folders often used by attackers for staging purposes
Author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
· 2022-06-02 (modified 2024-04-23) · logsource: product=windows category=process_creation · b96b2031-7c17-4473-afe7-a30ce714db29
Detects the execution of FSharp Interpreters "FsiAnyCpu.exe" and "FSi.exe"
Both can be used for AWL bypass and to execute F# code via scripts or inline.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-05-05 · logsource: product=windows category=file_event · bbb7e38c-0b41-4a11-b306-d2a457b7ac2b
Detects suspicious file based on their extension being created in "C:\PerfLogs\". Note that this directory mostly contains ".etl" files
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-12-02 (modified 2023-02-14) · logsource: product=windows category=process_creation · bdeeabc9-ff2a-4a51-be59-bb253aac7891
Detects usage of wsudo (Windows Sudo Utility). Which is a tool that let the user execute programs with different permissions (System, Trusted Installer, Administrator...etc)
Author: frack113, The DFIR Report
· 2022-03-02 (modified 2025-11-13) · logsource: product=windows category=process_creation · c0b2768a-dd06-4671-8339-b16ca8d1f27f
Detects the modification of NTFS symbolic link behavior using fsutil, which could be used to enable remote to local or remote to remote symlinks for potential attacks.
Author: Tim Rauch, Elastic (idea)
· 2022-09-16 (modified 2022-11-26) · logsource: product=windows category=ps_script · c1344fa2-323b-4d2e-9176-84b4d4821c88
Detects modifications to the Windows Defender configuration settings using PowerShell to add exclusions
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-04-17 (modified 2023-12-04) · logsource: product=windows category=process_creation · c15a46a0-07d4-4c87-b4b6-89207835a83b
Detects usage of winget to add new potentially suspicious download sources
Author: Nextron Systems
· 2022-06-03 (modified 2024-11-04) · logsource: product=linux category=process_creation · c4042d54-110d-45dd-a0e1-05c47822c937
Detects a python process calling to the PTY module in order to spawn a pretty tty which could be indicative of potential reverse shell activity.
Author: Markus Neis
· 2017-11-07 (modified 2022-10-09) · logsource: product=windows category=process_creation · c601f20d-570a-4cde-a7d6-e17f99cb8e7f
Detects automated lateral movement by Turla group
Author: Swachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali
· 2025-12-05 · logsource: product=linux category=process_creation · c70834fa-fb9d-4aa0-9e7d-45ceed36f3f7
Detects suspicious child processes spawned from Node.js server processes on Linux systems, potentially indicating remote code execution exploitation such as CVE-2025-55182 (React2Shell).
This rule particularly looks for exploitation of vulnerability on Node.js Servers where attackers abuse Node.js child_process module to execute arbitrary system commands.
When execSync() or exec() is used, the command line often includes a shell invocation followed by suspicious commands or scripts (e.g., /bin/sh -c <malicious-command>).
For other methods, the Image field will show the spawned process directly.
Author: Moriarty Meng (idea), Anton Kutepov (rule), oscd.community
· 2020-10-17 (modified 2021-11-27) · logsource: product=windows category=process_creation · c83bf4b5-cdf0-437c-90fa-43d734f7c476
Detects PowerShell script execution via input stream redirect
Author: Tim Rauch, Elastic (idea)
· 2022-09-28 (modified 2025-03-06) · logsource: product=windows category=process_creation · cbb9e3d1-2386-4e59-912e-62f1484f7a89
Detects when the Console Window Host (conhost.exe) process is spawned by an uncommon parent process, which could be indicative of potential code injection activity.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-06-03 · logsource: product=linux category=process_creation · d292e0af-9a18-420c-9525-ec0ac3936892
Detects java process spawning suspicious children
Author: Florian Roth (Nextron Systems)
· 2018-06-22 (modified 2021-11-27) · logsource: product=windows category=process_creation · d5b9ae7a-e6fc-405e-80ff-2ff9dcc64e7e
Detects suspicious sysprep process start with AppData folder as target (as used by Trojan Syndicasec in Thrip report by Symantec)
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-01-02 · logsource: product=windows category=process_creation · d81871ef-5738-47ab-9797-7a9c90cd4bfb
Detects execution of php using the "-r" flag. This is could be used as a way to launch a reverse shell or execute live php code.
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
· 2024-09-02 · logsource: product=linux category=process_creation · db1ac3be-f606-4e3a-89e0-9607cbe6b98a
Detects the use of the "capsh" utility to invoke a shell.
Author: Tomasz Dyduch, Josh Nickels
· 2024-05-31 · logsource: product=windows category=file_event · df49c691-8026-48dd-94d3-4ba6a79102a8
Detects attackers attempting to save, decrypt and execute the DarkGate Loader in C:\temp folder.
Author: Sohan G (D4rkCiph3r)
· 2023-02-18 · logsource: product=macos category=process_creation · e0cfaecd-602d-41af-988d-f6ccebb2af26
Detects the execution of suspicious child processes from macOS installer package parent process. This includes osascript, JXA, curl and wget amongst other interpreters
Author: Markus Neis, Nasreddine Bencherchali (Nextron Systems)
· 2018-12-27 (modified 2023-02-09) · logsource: product=windows category=process_creation · e212d415-0e93-435f-9e1a-f29005bb4723
Detects a suspicious child process spawning from Outlook where the image is located in a remote location (SMB/WebDav shares).
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Florian Roth
· 2024-09-02 (modified 2025-01-18) · logsource: product=linux category=process_creation · e2326866-609f-4015-aea9-7ec634e8aa04
Detects the use of the "rsync" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Author: Bhabesh Raj
· 2020-09-14 (modified 2022-12-07) · logsource: product=windows service=windefend · ea9bf0fa-edec-4fb8-8b78-b119f2528186
Detects triggering of AMSI by Windows Defender.
Author: Victor Sergeev, oscd.community
· 2020-10-09 (modified 2022-07-11) · logsource: product=windows category=process_creation · eca49c87-8a75-4f13-9c73-a5a29e845f03
Detects execution of powershell scripts via Runscripthelper.exe
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-10-10 · logsource: product=windows category=process_creation · eca8ae39-5c3c-4321-b538-9e64fe25822e
Detects installation of Kali Linux distribution through Windows Subsystem for Linux (WSL).
Attackers may use Kali Linux WSL to leverage its penetration testing tools and capabilities for malicious purposes.
Author: Florian Roth (Nextron Systems)
· 2022-02-11 (modified 2023-03-22) · logsource: product=windows category=process_creation · efdd8dd5-cee8-4e59-9390-7d4d5e4dd6f6
Detects suspicious patterns in program names or folders that are often found in malicious samples or hacktools
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2021-07-27 (modified 2023-03-29) · logsource: product=windows category=process_creation · f35c5d71-b489-4e22-a115-f003df287317
Detects potential process patterns related to Cobalt Strike beacon activity
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-01-02 · logsource: product=windows category=process_creation · f426547a-e0f7-441a-b63e-854ac5bdf54d
Detects execution of perl using the "-e"/"-E" flags. This is could be used as a way to launch a reverse shell or execute live perl code.
Author: Andreas Braathen (mnemonic.io)
· 2023-11-14 · logsource: product=linux category=process_creation · f8987c03-4290-4c96-870f-55e75ee377f4
Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.
Author: frack113
· 2022-03-12 · logsource: product=windows category=process_creation · f8ad2e2c-40b6-4117-84d7-20b89896ab23
Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system
Author: Micah Babinski
· 2023-10-15 · logsource: product=windows category=process_creation · f8e9aa1c-14f2-4dbd-aa59-b98968ed650d
Detects execution of the legitimate Autoit3 utility from a suspicious parent process. AutoIt3.exe is used within
the DarkGate infection chain to execute shellcode that performs process injection and connects to the DarkGate
command-and-control server.
Author: X__Junior
· 2025-01-20 · logsource: product=windows category=image_load · fb4e2211-6d08-426b-8e6f-0d4a161e3b1d
Detects Clfs.sys being loaded by a process running from a potentially suspicious location. Clfs.sys is loaded as part of many CVEs exploits that targets Common Log File.