{"id":"002bdb95-0cf1-46a6-9e08-d38c128a6127","title":"WScript or CScript Dropper - File","description":"Detects a file ending in jse, vbe, js, vba, vbs, wsf, wsh written by cscript.exe or wscript.exe","author":"Tim Shelton","status":"test","level":"high","date":"2022-01-10","modified":"2026-02-17","tags":["attack.execution","attack.t1059.005","attack.t1059.007"],"technique_ids":["T1059.005","T1059.007"],"logsource":{"category":"file_event","product":"windows"},"falsepositives":["Unknown"],"references":["WScript or CScript Dropper (cea72823-df4d-4567-950c-0b579eaf0846)"],"source_path":"rules/windows/file/file_event/file_event_win_cscript_wscript_dropper.yml","source_sha256":"abbecdb06428f9caf98c2bde60f7d5a2d248f92137bd27f4b151a62f9c930dee","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_cscript_wscript_dropper.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: WScript or CScript Dropper - File\nid: 002bdb95-0cf1-46a6-9e08-d38c128a6127\nrelated:\n    - id: cea72823-df4d-4567-950c-0b579eaf0846\n      type: derived\nstatus: test\ndescription: Detects a file ending in jse, vbe, js, vba, vbs, wsf, wsh written by cscript.exe or wscript.exe\nreferences:\n    - WScript or CScript Dropper (cea72823-df4d-4567-950c-0b579eaf0846)\nauthor: Tim Shelton\ndate: 2022-01-10\nmodified: 2026-02-17\ntags:\n    - attack.execution\n    - attack.t1059.005\n    - attack.t1059.007\nlogsource:\n    category: file_event\n    product: windows\ndetection:\n    selection:\n        Image|endswith:\n            - '\\wscript.exe'\n            - '\\cscript.exe'\n        TargetFilename|contains:\n            - ':\\Perflogs\\'\n            - ':\\ProgramData\\'\n            - ':\\Temp\\'\n            - ':\\Tmp\\'\n            - ':\\Users\\'\n            - ':\\Windows\\Temp\\'\n            - '\\AppData\\Local\\Temp'\n            - '\\AppData\\Roaming\\Temp'\n            - '\\Start Menu\\Programs\\Startup\\'\n            - '\\Temporary Internet'\n        TargetFilename|endswith:\n            - '.js'\n            - '.jse'\n            - '.vba'\n            - '.vbe'\n            - '.vbs'\n            - '.wsf'\n            - '.wsh'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.005","id":"T1059.005","name":"Visual Basic","page":"techniques/enterprise/T1059.005/"},{"key":"enterprise/T1059.007","id":"T1059.007","name":"JavaScript","page":"techniques/enterprise/T1059.007/"}],"data_path":"data/detection-rules/002bdb95-0cf1-46a6-9e08-d38c128a6127.json","kind":"sigma"}