Potential Dropper Script Execution Via WScript/CScript/MSHTA

Title: Potential Dropper Script Execution Via WScript/CScript/MSHTA
Status: test
Description:Detects wscript/cscript/mshta executions of scripts located in user directories
References:
  -https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/
  -https://redcanary.com/blog/gootloader/
  -https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/
Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community, Nasreddine Bencherchali (Nextron Systems), Dave Johnson
Date: 2019-01-16
modified:2026-02-17
Tags:

• -'attack.execution'
• -'attack.t1059.005'
• -'attack.t1059.007'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_exec:
    Image|endswith:
      -'\wscript.exe'
      -'\cscript.exe'
      -'\mshta.exe'

  selection_paths:
    CommandLine|contains:
      -':\Perflogs\'
      -':\Temp\'
      -':\Tmp\'
      -':\Users\Public\'
      -':\Windows\Temp\'
      -'\AppData\Local\Temp\'
      -'\AppData\Roaming\Temp\'
      -'\Start Menu\Programs\Startup\'
      -'\Temporary Internet'
      -'\Windows\Temp'
      -'%LocalAppData%\Temp\'
      -'%TEMP%'
      -'%TMP%'

  selection_ext:
    CommandLine|contains:
      -'.hta'
      -'.js'
      -'.jse'
      -'.vba'
      -'.vbe'
      -'.vbs'
      -'.wsf'
      -'.wsh'

  condition:all of selection_*
Falsepositives:
  -Some installers might generate a similar behavior. An initial baseline is required
Level: medium