Manual Execution of Script Inside of a Compressed File

SIGMA detection rule by @kostastsale · GPL-2.0

This is a threat-hunting query to collect information related to the interactive execution of a script from inside a compressed file (zip/rar). Windows will automatically run the script using scripting interpreters such as wscript and cscript binaries. From the query below, the child process is the script interpreter that will execute the script. The script extension is also a set of standard extensions that Windows OS recognizes. Selections 1-3 contain three different execution scenarios. 1. Compressed file opened using 7zip. 2. Compressed file opened using WinRar. 3. Compressed file opened using native windows File Explorer capabilities. When the malicious script is double-clicked, it will be extracted to the respected directories as signified by the CommandLine on each of the three Selections. It will then be executed using the relevant script interpreter."

title: Manual Execution of Script Inside of a Compressed File
id: e86bcb59-4f56-b91f-1c5f-100512b9d367
related:
    - id: 95724fc1-a258-4674-97db-a30351981c5a
      type: derived
status: test
description: |
    This is a threat-hunting query to collect information related to the interactive execution of a script from inside a compressed file (zip/rar). Windows will automatically run the script using scripting interpreters such as wscript and cscript binaries.

    From the query below, the child process is the script interpreter that will execute the script. The script extension is also a set of standard extensions that Windows OS recognizes. Selections 1-3 contain three different execution scenarios.
        1. Compressed file opened using 7zip.
        2. Compressed file opened using WinRar.
        3. Compressed file opened using native windows File Explorer capabilities.

    When the malicious script is double-clicked, it will be extracted to the respected directories as signified by the CommandLine on each of the three Selections. It will then be executed using the relevant script interpreter."
references:
    - https://app.any.run/tasks/25970bb5-f864-4e9e-9e1b-cc8ff9e6386a
    - https://app.any.run/tasks/fa99cedc-9d2f-4115-a08e-291429ce3692
author: '@kostastsale'
date: 2023-02-15
modified: 2024-08-13
tags:
    - attack.execution
    - attack.t1059
    - detection.threat-hunting
logsource:
    category: process_creation
    product: windows
detection:
    process_creation:
        EventID: 4688
        Channel: Security
    selection_parent_7zip:
        CommandLine|contains: \AppData\local\temp\7z*\
        ParentProcessName|endswith: \7z*.exe
    selection_parent_winrar:
        CommandLine|contains: \AppData\local\temp\rar*\
        ParentProcessName|endswith: \winrar.exe
    selection_parent_explorer:
        CommandLine|contains:
            - \AppData\local\temp\*.rar\
            - \AppData\local\temp\*.zip\
        ParentProcessName|endswith: \explorer.exe
    selection_child:
        CommandLine|endswith:
            - .hta
            - .js
            - .jse
            - .ps1
            - .vbe
            - .vbs
            - .wsf
            - .wsh
        NewProcessName|endswith:
            - \cscript.exe
            - \mshta.exe
            - \powershell.exe
            - \pwsh.exe
            - \wscript.exe
    condition: process_creation and (1 of selection_parent_* and selection_child)
falsepositives:
    - Batch files may produce a lot of noise, as many applications appear to bundle them as part of their installation process. You should baseline your environment and generate a new query excluding the noisy and expected activity. Some false positives may come up depending on your environment. All results should be investigated thoroughly before filtering out results.
level: medium
ruletype: Sigma

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

9a66a068-30ce-49c4-a5a7-f5f46e71fc8f

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion