Windows Shell/Scripting Processes Spawning Suspicious Programs
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, mshta...etc.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Process started" AND (PARENTPROCESSNAME endswith "\mshta.exe,\powershell.exe,\pwsh.exe,\rundll32.exe,\cscript.exe,\wscript.exe,\wmiprvse.exe,\regsvr32.exe" AND PROCESSNAME endswith "\schtasks.exe,\nslookup.exe,\certutil.exe,\bitsadmin.exe,\mshta.exe") AND (CWD notcontains "\ccmcache" AND PARENTPROCESSCOMMANDLINE notcontains "\Program Files\Amazon\WorkSpacesConfig\Scripts\setup-scheduledtask.ps1,\Program Files\Amazon\WorkSpacesConfig\Scripts\set-selfhealing.ps1,\Program Files\Amazon\WorkSpacesConfig\Scripts\check-workspacehealth.ps1,\nessus_" AND COMMANDLINE notcontains "\nessus_" AND (PARENTPROCESSNAME notendswith "\mshta.exe" OR PROCESSNAME notendswith "\mshta.exe" OR (PARENTPROCESSCOMMANDLINE notcontains "C:\MEM_Configmgr_" OR PARENTPROCESSCOMMANDLINE notcontains "\splash.hta" OR PARENTPROCESSCOMMANDLINE notcontains "{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}") OR (COMMANDLINE notcontains "C:\MEM_Configmgr_" OR COMMANDLINE notcontains "\SMSSETUP\BIN" OR COMMANDLINE notcontains "\autorun.hta" OR COMMANDLINE notcontains "{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}"))) select Action1.HOSTNAME,Action1.MESSAGE,Action1.COMMANDLINE,Action1.FILE_NAME,Action1.PROCESSNAME,Action1.USERNAME,Action1.PARENTPROCESSNAME
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Florian Roth (Nextron Systems), Tim Shelton
