Detection of Script Interpreter Execution from Suspicious Directories

Adversaries often weaponize built-in Windows script interpreters to execute malicious code within a compromised environment. By placing scripts in directories like Temp, Public, or user-profile folders, attackers leverage locations where they have write permissions, minimizing the likelihood of triggering security alerts associated with system-wide changes. These techniques are often employed during the initial access or post-exploitation phases, using interpreters like cscript.exe, wscript.exe, and mshta.exe to carry out tasks such as code execution, persistence, or data staging. Defending against this requires monitoring for process creation events where these specific interpreters are invoked from anomalous paths, particularly when combined with execution policy bypass flags or hidden window parameters.

Attack Chain

1. Attacker establishes initial access via phishing or vulnerability exploitation.
2. Attacker writes a malicious script or shellcode-based payload to a writable directory like %TEMP% or C:\Users\Public.
3. Attacker stages a secondary script or executable in the same user-writable location.
4. Attacker invokes a legitimate script interpreter process (cscript, wscript, or mshta).
5. Interpreter process executes the staged script using command-line arguments to bypass execution policies or hide windows (e.g., -ep bypass).
6. Malicious code executes in the context of the user, leading to potential credential dumping or C2 beaconing.
7. Final objective achieved, such as long-term persistence or data exfiltration.

Impact

Successful exploitation of this technique allows attackers to execute arbitrary code with the permissions of the compromised user account. This often serves as a precursor to lateral movement, data theft, or the deployment of ransomware. Victims in sectors such as military, government, and critical infrastructure have been observed targeted by sophisticated groups leveraging these living-off-the-land techniques.

Recommendation

Deploy the provided Sigma rule to identify script execution from known user-writable or temporary directories and tune against baseline environment noise.

• Enable Sysmon or Windows Security event logging (Event ID 4688) to capture process creation telemetry.
• Review and baseline legitimate administrative or installation scripts that trigger this behavior to create robust filter sets for the Sigma rule.
• Monitor for unauthorized files created in \Users\Public\ and \AppData\Local\Temp\ directories.