Suspicious Runscripthelper.exe

Title: Suspicious Runscripthelper.exe
Status: test
Description:Detects execution of powershell scripts via Runscripthelper.exe
References:
  -https://lolbas-project.github.io/lolbas/Binaries/Runscripthelper/
Author: Victor Sergeev, oscd.community
Date: 2020-10-09
modified:2022-07-11
Tags:

• -'attack.execution'
• -'attack.stealth'
• -'attack.t1059'
• -'attack.t1202'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    Image|endswith: '\Runscripthelper.exe'
    CommandLine|contains: 'surfacecheck'
  condition:selection
Falsepositives:
  -Unknown
Level: medium