Cscript/Wscript Uncommon Script Extension Execution

Rule Info

Tags
attack.execution attack.t1059.007 attack.t1059.005 DEMO
Name
Cscript/Wscript Uncommon Script Extension Execution
Id
99b7460d-c9f1-40d7-a316-1f36f61d52ee
Date
2023-05-15 00:00:00
Modified
None
Description
Detects Wscript/Cscript executing a file with an uncommon (i.e. non-script) extension
Reference
None
Author
Nasreddine Bencherchali (Nextron Systems)
Type
Community Rule

Rule History

Title
Author
Commit
Date
feat: multiple updates and new rules (#4242)
Nasreddine Bencherchali
2023-05-17