{"id":"1228c958-e64e-4e71-92ad-7d429f4138ba","title":"Script Interpreter Execution From Suspicious Folder","description":"Detects suspicious script execution from suspicious directories or folders accessible by environment variables that may indicate malware activity.\nScript interpreters (cscript, wscript, mshta, powershell) executing from folders like Temp, Public, or user profile directories may suggest attempts to evade detection or execute malicious scripts.\n","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-02-08","modified":"2026-02-17","tags":["attack.execution","attack.t1059"],"technique_ids":["T1059"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Various legitimate software have been observed to use similar techniques for installation or update purposes;thus, it is recommended to review and tune filters for your environment to reduce false positives before deploying to production."],"references":["https://www.virustotal.com/gui/file/91ba814a86ddedc7a9d546e26f912c541205b47a853d227756ab1334ade92c3f","https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-russia-ukraine-military","https://learn.microsoft.com/en-us/windows/win32/shell/csidl"],"source_path":"rules/windows/process_creation/proc_creation_win_susp_script_exec_from_env_folder.yml","source_sha256":"4bc9d5c0b23c4e04f80c9238ea1fc20340d795a7d750dbc5154e85ab5749af16","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_script_exec_from_env_folder.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Script Interpreter Execution From Suspicious Folder\nid: 1228c958-e64e-4e71-92ad-7d429f4138ba\nstatus: test\ndescription: |\n    Detects suspicious script execution from suspicious directories or folders accessible by environment variables that may indicate malware activity.\n    Script interpreters (cscript, wscript, mshta, powershell) executing from folders like Temp, Public, or user profile directories may suggest attempts to evade detection or execute malicious scripts.\nreferences:\n    - https://www.virustotal.com/gui/file/91ba814a86ddedc7a9d546e26f912c541205b47a853d227756ab1334ade92c3f\n    - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-russia-ukraine-military\n    - https://learn.microsoft.com/en-us/windows/win32/shell/csidl\nauthor: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-02-08\nmodified: 2026-02-17\ntags:\n    - attack.execution\n    - attack.t1059\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_proc_image:\n        Image|endswith:\n            - '\\cscript.exe'\n            - '\\mshta.exe'\n            - '\\wscript.exe'\n    selection_proc_flags:\n        CommandLine|contains:\n            - ' -ep bypass '\n            - ' -ExecutionPolicy bypass '\n            - ' -w hidden '\n            - '/e:javascript '\n            - '/e:Jscript '\n            - '/e:vbscript '\n    selection_proc_original:\n        OriginalFileName:\n            - 'cscript.exe'\n            - 'mshta.exe'\n            - 'wscript.exe'\n    selection_folders_1:\n        CommandLine|contains:\n            - ':\\Perflogs\\'\n            - ':\\Users\\Public\\'\n            - '\\%Public%'\n            - '\\AppData\\Local\\Temp'\n            - '\\AppData\\Roaming\\Temp'\n            - '\\Temporary Internet'\n            - '\\Windows\\Temp'\n            - '\\Start Menu\\Programs\\Startup\\'\n            - '%TEMP%'\n            - '%TMP%'\n            - '%LocalAppData%\\Temp'\n    selection_folders_2:\n        - CommandLine|contains|all:\n              - ':\\Users\\'\n              - '\\Favorites\\'\n        - CommandLine|contains|all:\n              - ':\\Users\\'\n              - '\\Favourites\\'\n        - CommandLine|contains|all:\n              - ':\\Users\\'\n              - '\\Contacts\\'\n        - CommandLine|contains|all:\n              - ':\\Users\\'\n              - '\\Documents\\'\n        - CommandLine|contains|all:\n              - ':\\Users\\'\n              - '\\Music\\'\n        - CommandLine|contains|all:\n              - ':\\Users\\'\n              - '\\Pictures\\'\n        - CommandLine|contains|all:\n              - ':\\Users\\'\n              - '\\Videos\\'\n    filter_optional_chocolatey_installer:\n        ParentImage:\n            - 'C:\\Windows\\System32\\Msiexec.exe'\n            - 'C:\\Windows\\SysWOW64\\Msiexec.exe'\n        Image|endswith: '\\powershell.exe'\n        CommandLine|contains|all:\n            - '-NoProfile -ExecutionPolicy Bypass -Command'\n            - 'AppData\\Local\\Temp\\'\n            - 'Install-Chocolatey.ps1'\n    condition: 1 of selection_proc_* and 1 of selection_folders_* and not 1 of filter_optional_*\nfalsepositives:\n    - Various legitimate software have been observed to use similar techniques for installation or update purposes;thus, it is recommended to review and tune filters for your environment to reduce false positives before deploying to production.\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059","id":"T1059","name":"Command and Scripting Interpreter","page":"techniques/enterprise/T1059/"}],"data_path":"data/detection-rules/1228c958-e64e-4e71-92ad-7d429f4138ba.json","kind":"sigma"}