Suspicious Reconnaissance Activity via GatherNetworkInfo.VBS

GatherNetworkInfo.vbs is a legitimate, built-in Windows administrative script located in "C:\Windows\System32" designed to assist in gathering system network information for troubleshooting purposes. Threat actors increasingly leverage this script as a Living-off-the-Land (LotL) technique to perform stealthy reconnaissance on compromised hosts. By executing this script, an attacker can obtain detailed network configuration, routing tables, and interface information without deploying additional malware. This technique is particularly effective for post-exploitation discovery, as the script is signed by Microsoft and exists in the baseline of many Windows installations. Defenders should monitor for unexpected execution of this script, especially when it is not initiated by standard system management tools or administrative workflows.

Impact

Successful execution of this technique allows unauthorized actors to map internal network segments, identify active network interfaces, and collect sensitive configuration data that facilitates further lateral movement and privilege escalation. While no specific victim counts are reported, this method has been observed in campaigns targeting government infrastructure and enterprise environments.

Recommendation

• Deploy the provided Sigma rule to detect non-standard execution of GatherNetworkInfo.vbs.
• Establish a baseline of legitimate administrative activity involving the Windows System32 directory to reduce false positives.
• Correlate execution events with parent process information to identify potential malicious actors or tools attempting to bypass standard script interpreters.