{"id":"575dce0c-8139-4e30-9295-1ee75969f7fe","title":"Potential Reconnaissance Activity Via GatherNetworkInfo.VBS","description":"Detects execution of the built-in script located in \"C:\\Windows\\System32\\gatherNetworkInfo.vbs\". Which can be used to gather information about the target machine","author":"blueteamer8699","status":"test","level":"medium","date":"2022-01-03","modified":"2023-02-08","tags":["attack.discovery","attack.execution","attack.t1615","attack.t1059.005"],"technique_ids":["T1059.005","T1615"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Administrative activity"],"references":["https://posts.slayerlabs.com/living-off-the-land/#gathernetworkinfovbs","https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government"],"source_path":"rules/windows/process_creation/proc_creation_win_lolbin_gather_network_info.yml","source_sha256":"1f28b5076bb9235ba20d8568568c4bf2976996d36f0aab943d91f2d79d448371","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_lolbin_gather_network_info.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Reconnaissance Activity Via GatherNetworkInfo.VBS\nid: 575dce0c-8139-4e30-9295-1ee75969f7fe\nrelated:\n    - id: f92a6f1e-a512-4a15-9735-da09e78d7273 # FileCreate\n      type: similar\n    - id: 07aa184a-870d-413d-893a-157f317f6f58 # ProcCreation Susp\n      type: similar\nstatus: test\ndescription: Detects execution of the built-in script located in \"C:\\Windows\\System32\\gatherNetworkInfo.vbs\". Which can be used to gather information about the target machine\nreferences:\n    - https://posts.slayerlabs.com/living-off-the-land/#gathernetworkinfovbs\n    - https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government\nauthor: blueteamer8699\ndate: 2022-01-03\nmodified: 2023-02-08\ntags:\n    - attack.discovery\n    - attack.execution\n    - attack.t1615\n    - attack.t1059.005\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith:\n              - '\\cscript.exe'\n              - '\\wscript.exe'\n        - OriginalFileName:\n              - 'cscript.exe'\n              - 'wscript.exe'\n    selection_cli:\n        CommandLine|contains: 'gatherNetworkInfo.vbs'\n    condition: all of selection_*\nfalsepositives:\n    - Administrative activity\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.005","id":"T1059.005","name":"Visual Basic","page":"techniques/enterprise/T1059.005/"},{"key":"enterprise/T1615","id":"T1615","name":"Group Policy Discovery","page":"techniques/enterprise/T1615/"}],"data_path":"data/detection-rules/575dce0c-8139-4e30-9295-1ee75969f7fe.json","kind":"sigma"}