1200KM / sigma-rule

Wscript Shell Run In CommandLine — Sigma Rule

Sigma rule 2c28c248-7f50-417a-9186-a85b223010ee. Wscript Shell Run In CommandLine — Sigma Rule. Detects the presence of the keywords "Wscript", "Shell" and "Run" in the command, which could indicate a suspicious activity

Rule metadata and linked tags

Author: Nasreddine Bencherchali (Nextron Systems). Source status: test; severity: medium. Source dates: 2022-08-31 / 2023-05-15.

{
  "category": "process_creation",
  "product": "windows"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: ddde15abf9201d46a61405028237093ea725001860b835d4e6ed4ee4670317c9

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Wscript Shell Run In CommandLine
id: 2c28c248-7f50-417a-9186-a85b223010ee
status: test
description: Detects the presence of the keywords "Wscript", "Shell" and "Run" in the command, which could indicate a suspicious activity
references:
    - https://web.archive.org/web/20220830122045/http://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html
    - https://blog.talosintelligence.com/modernloader-delivers-multiple-stealers-cryptominers-and-rats/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-08-31
modified: 2023-05-15
tags:
    - attack.execution
    - attack.t1059
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains|all:
            - 'Wscript.'
            - '.Shell'
            - '.Run'
    condition: selection
falsepositives:
    - Inline scripting can be used by some rare third party applications or administrators. Investigate and apply additional filters accordingly
level: medium

Original YAML and metadata in JSON

False positives

Inline scripting can be used by some rare third party applications or administrators. Investigate and apply additional filters accordingly

Source references

Connected ecosystem references

Exact source-tagged techniques

T1059 · Command and Scripting Interpreter · Detection rules & anomalies

Telemetry review

Read the original logsource above, then inspect the linked detection workspaces for technique-level sensor context. No per-rule telemetry equivalence is inferred.

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.