Suspicious Child Process Creation by Wscript or Cscript

This brief details a common adversary technique involving the use of Windows Script Host (WScript.exe or CScript.exe) to spawn suspicious child processes. This method is frequently employed by various threat actors and malware to facilitate defense evasion and execution. By leveraging WScript or CScript, attackers can execute Living Off The Land Binaries (LOLBINs) such as regsvr32.exe, rundll32.exe, certutil.exe, msbuild.exe, wmic.exe, and mshta.exe, or launch scripting interpreters like cmd.exe, powershell.exe, and pwsh.exe. This technique also enables attackers to spawn processes in a suspended state for code injection. While some legitimate scripts may use these tools, the detection serves as a strong indicator of potentially malicious activity aimed at bypassing security controls and advancing an attack.

Impact

Successful execution of this technique can lead to a variety of negative outcomes, depending on the specific child process launched and the attacker's objectives. It enables adversaries to execute malicious code, establish persistence, elevate privileges, or perform data exfiltration, ultimately leading to system compromise, data loss, or the deployment of destructive malware. This technique is observed in campaigns related to data destruction, remote access Trojans (RATs) such as NjRAT and Remcos, and other advanced persistent threats, indicating its potential to facilitate severe operational disruption and financial damage.

Recommendation

• Deploy the Sigma rule "Detect Suspicious Child Process by Wscript or Cscript" to your SIEM and tune for your environment to identify adversary activity.
• Ensure process creation logging, specifically Sysmon EventID 1 or Windows Event Log Security 4688, is enabled and configured to capture parent and child process details, including command-line arguments, as required by the Sigma rule.
• Investigate alerts generated by the "Detect Suspicious Child Process by Wscript or Cscript" rule, cross-referencing process lineage and command-line parameters with known legitimate activity.
• Analyze the sample available at https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120 to understand related behaviors if your organization encounters this specific threat.