Outbound Network Connection Initiated By Script Interpreter

Title: Outbound Network Connection Initiated By Script Interpreter
Status: test
Description:Detects a script interpreter wscript/cscript opening a network connection to a non-local network. Adversaries may use script to download malicious payloads.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/28d190330fe44de6ff4767fc400cc10fa7cd6540/atomics/T1105/T1105.md
Author: frack113, Florian Roth (Nextron Systems)
Date: 2022-08-28
modified:2024-03-13
Tags:

• -'attack.command-and-control'
• -'attack.t1105'

Logsource:

• category: network_connection
• product: windows

Detection:
  selection:
    Initiated: 'true'
    Image|endswith:
      -'\wscript.exe'
      -'\cscript.exe'

  filter_main_local_ranges:
    DestinationIp|cidr:
      -'127.0.0.0/8'
      -'10.0.0.0/8'
      -'172.16.0.0/12'
      -'192.168.0.0/16'
      -'169.254.0.0/16'
      -'::1/128'
      -'fe80::/10'
      -'fc00::/7'

  filter_main_ms_ranges:
    DestinationIp|cidr: '20.0.0.0/11'
  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Legitimate scripts
Level: high