Rule Info
Name
Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBS
Author
Nasreddine Bencherchali (Nextron Systems)
Description
Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine
Date
2023-02-08 00:00:00
Modified
None
Id
07aa184a-870d-413d-893a-157f317f6f58
Tags
attack.discovery attack.execution attack.t1615 attack.t1059.005
Type
Community Rule
Link to Public Repo
Scan your endpoints, forensic images or collected files with our portable scanner THOR