{"id":"07aa184a-870d-413d-893a-157f317f6f58","title":"Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBS","description":"Detects execution of the built-in script located in \"C:\\Windows\\System32\\gatherNetworkInfo.vbs\". Which can be used to gather information about the target machine","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-02-08","modified":"","tags":["attack.discovery","attack.execution","attack.t1615","attack.t1059.005"],"technique_ids":["T1059.005","T1615"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://posts.slayerlabs.com/living-off-the-land/#gathernetworkinfovbs","https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government"],"source_path":"rules/windows/process_creation/proc_creation_win_susp_gather_network_info_execution.yml","source_sha256":"ade9f4f3bdbb8777fbb7724e1fd826c4675787e00d16ee8ea236df73905d830d","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_gather_network_info_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBS\nid: 07aa184a-870d-413d-893a-157f317f6f58\nrelated:\n    - id: f92a6f1e-a512-4a15-9735-da09e78d7273 # FileCreate\n      type: similar\n    - id: 575dce0c-8139-4e30-9295-1ee75969f7fe # ProcCreation LOLBIN\n      type: similar\nstatus: test\ndescription: Detects execution of the built-in script located in \"C:\\Windows\\System32\\gatherNetworkInfo.vbs\". Which can be used to gather information about the target machine\nreferences:\n    - https://posts.slayerlabs.com/living-off-the-land/#gathernetworkinfovbs\n    - https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2023-02-08\ntags:\n    - attack.discovery\n    - attack.execution\n    - attack.t1615\n    - attack.t1059.005\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine|contains: 'gatherNetworkInfo.vbs'\n    filter:\n        Image|endswith:\n            - '\\cscript.exe'\n            - '\\wscript.exe'\n    condition: selection and not filter\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.005","id":"T1059.005","name":"Visual Basic","page":"techniques/enterprise/T1059.005/"},{"key":"enterprise/T1615","id":"T1615","name":"Group Policy Discovery","page":"techniques/enterprise/T1615/"}],"data_path":"data/detection-rules/07aa184a-870d-413d-893a-157f317f6f58.json","kind":"sigma"}