Execution of Downloaded Windows Script

This detection identifies instances where a Windows script file is created after being downloaded from the internet and subsequently executed using a scripting utility. Adversaries commonly exploit Windows script files for initial access and execution within a compromised environment. This technique involves downloading malicious scripts via web browsers or file utilities, followed by execution through scripting engines like wscript.exe, cscript.exe, or mshta.exe. The rule focuses on identifying anomalous parent-child process relationships and suspicious attributes associated with these scripts, such as their origin URL, referrer URL, and file extension. The detection logic specifically monitors the creation of script files with extensions like .js, .vbs, .ps1, and others, originating from internet sources, and their subsequent execution by scripting interpreters. This behavior is often indicative of malicious activity, potentially leading to further compromise or lateral movement within the network.

Attack Chain

1. User downloads a malicious script file (e.g., .js, .vbs, .ps1) from the internet using a web browser such as Chrome, Edge, or Firefox or file utilites like Winrar or 7zip.
2. The downloaded file is saved to disk with the creation event being logged.
3. A scripting host process (e.g., wscript.exe, cscript.exe, mshta.exe, powershell.exe, cmd.exe) is spawned.
4. The scripting host process executes the downloaded script file, utilizing command-line arguments to specify the script's execution. For example, wscript.exe malicious.vbs.
5. The script performs malicious actions, such as downloading additional payloads or modifying system configurations.
6. Depending on the script's purpose, it may establish persistence, for instance, by creating scheduled tasks or modifying registry keys.
7. The script may attempt lateral movement by accessing network shares or exploiting vulnerabilities on other systems.
8. The final objective depends on the attacker's goals, ranging from data exfiltration to deploying ransomware.

Impact

Successful exploitation can lead to arbitrary code execution, allowing attackers to gain control over the compromised system. This can result in data theft, system damage, or further propagation of the attack within the network. The detection rule aims to identify and prevent such attacks early in the attack chain. While the scope of targeting remains broad, organizations that do not properly vet external scripts face a greater risk. If successful, an attacker could move laterally within the network, potentially impacting hundreds or thousands of systems.

Recommendation

• Deploy the Sigma rule "Downloaded Script File Creation followed by Scripting Host Execution" to your SIEM to detect this activity (see rule below).
• Deploy the Sigma rule "Execution of Downloaded Windows Script via Mshta" to your SIEM to specifically detect execution via mshta.exe.
• Monitor process creation events for scripting hosts (wscript.exe, cscript.exe, mshta.exe, powershell.exe, cmd.exe) with command-line arguments pointing to downloaded script files.
• Implement application control policies to restrict the execution of unauthorized scripting hosts.
• Enforce strict download policies to prevent users from downloading executable content from untrusted sources.
• Review the investigation steps outlined in the original rule documentation to improve triage efficiency.