Techniques › T1059.005 › AN0209
AN0209 Analytic 0209
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects execution of VB-based scripts or macros (VBS/VBA/VBScript) through cscript.exe/wscript.exe, Office-based process chains, or HTA usage. Focuses on chained behavior: Office or HTML container spawns script host > script host spawns PowerShell, network connections, or process injection.</p>
- Detects
- T1059.005 Visual Basic
- Part of
- DET0076 Behavioral Detection of Visual Basic Execution (VBS/VBA/VBScript)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
| WinEventLog:Sysmon | EventCode=7 | DC0016 Module Load |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
ParentProcess | Microsoft Word/Excel or mshta.exe spawning wscript.exe/cscript.exe. |
UserContext | Script execution by non-admin users or service accounts. |
TimeWindow | Script execution outside normal business hours or patching cycle. |
PayloadEntropyThreshold | High entropy indicative of obfuscation or encoding in the script. |
ModuleName | Loading of vbscript.dll, scrrun.dll, or other scripting engine modules. |