Techniques › T1059 › T1059.007
T1059.007 JavaScript
execution — Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
29
Sigma rules tagged attack.t1059.007
14
KEV CVEs mapped here
<p>Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.</p><p>JScript is the Microsoft implementation of the same scripting standard. JScript is interpreted via the Windows Script engine and thus integrated with many components of Windows such as the Component Object Model and Internet Explorer HTML Application (HTA) pages.</p><p>JavaScript for Automation (JXA) is a macOS scripting language based on JavaScript, included as part of Apple’s Open Scripting Architecture (OSA), that was introduced in OSX 10.10. Apple’s OSA provides scripting capabilities to control applications, interface with the operating system, and bridge access into the rest of Apple’s internal APIs. As of OSX 10.10, OSA only supports two languages, JXA and AppleScript. Scripts can be executed via the command line utility <code>osascript</code>, they can be compiled into applications or script files via <code>osacompile</code>, and they can be compiled and executed in memory of other programs by leveraging the OSAKit Framework.</p><p>Adversaries may abuse various implementations of JavaScript to execute various behaviors. Common uses include hosting malicious scripts on websites as part of a Drive-by Compromise or downloading and executing these script files as secondary payloads. Since these payloads are text-based, it is also very common for adversaries to obfuscate their content as part of Obfuscated Files or Information.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2025-34028 | Commvault Command Center | primary impact | Mapped | 2025-05-02 |
| CVE-2023-5631 | Roundcube Webmail | primary impact | Mapped | 2023-10-26 |
| CVE-2023-22515 | Atlassian Confluence Data Center and Server | primary impact | Mapped | 2023-10-05 |
| CVE-2023-26360 | Adobe ColdFusion | primary impact | Mapped | 2023-03-15 |
| CVE-2022-22963 | VMware Tanzu Spring Cloud | primary impact | Mapped | 2022-08-25 |
| CVE-2018-4990 | Adobe Acrobat and Reader | exploitation technique | Mapped | 2022-06-08 |
| CVE-2015-5119 | Adobe Flash Player | exploitation technique | Mapped | 2022-03-03 |
| CVE-2013-3346 | Adobe Reader and Acrobat | exploitation technique | Mapped | 2022-03-03 |
| CVE-2022-24682 | Synacor Zimbra Collaborate Suite (ZCS) | primary impact | Mapped | 2022-02-25 |
| CVE-2021-21166 | Google Chromium | exploitation technique | Mapped | 2021-11-03 |
| CVE-2021-21148 | Google Chromium V8 | exploitation technique | Mapped | 2021-11-03 |
| CVE-2021-37975 | Google Chromium V8 | exploitation technique | Mapped | 2021-11-03 |
| CVE-2021-30554 | Google Chromium WebGL | exploitation technique | Mapped | 2021-11-03 |
| CVE-2021-21206 | Google Chromium Blink | exploitation technique | Mapped | 2021-11-03 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0264 Cross-Platform Detection of JavaScript Execution Abuse v1.0
AN0733 WindowsDetects JavaScript execution through WSH (wscript.exe, cscript.exe) or HTA (mshta.exe), particularly when spawned from Office macros, web browsers, or abnormal user paths. Correlates script execution with outbound network activity or system modification.Tunable:
ParentProcessScriptPathTimeWindowUserContextEntropyScoreAN0734 macOSDetects JavaScript for Automation (JXA) via osascript or compiled scripts using OSAKit APIs. Flags execution involving system modification, inter-process scripting, or browser abuse.macos:unifiedloglog stream with predicate 'eventMessage CONTAINS "osascript"'→ DC0029 Script ExecutionTunable:ScriptLocationParentProcessAPIInvocationAN0735 LinuxDetects Node.js or JavaScript interpreter execution from web shells, cron jobs, or local users. Correlates execution with reverse shell behavior, file modifications, or abnormal outbound connections.Tunable:ScriptPathBinaryNameUserExecutionContextNetworkFollowUp
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1059.007
Author: Tim Shelton
· 2022-01-10 (modified 2026-02-17) · logsource: product=windows category=file_event · 002bdb95-0cf1-46a6-9e08-d38c128a6127
Detects a file ending in jse, vbe, js, vba, vbs, wsf, wsh written by cscript.exe or wscript.exe
Author: Timur Zinniatullin, oscd.community, Swachchhanda Shrawan Poudel
· 2019-10-21 (modified 2026-01-24) · logsource: product=windows category=process_creation · 05c36dd6-79d6-4a9a-97da-3db20298ab2d
Detects the execution of WMIC with the "format" flag to potentially load local XSL files.
Adversaries abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses.
Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files.
Author: Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community
· 2017-11-10 (modified 2022-12-02) · logsource: product=windows category=file_event · 0bcfabcb-7929-47f4-93d6-b33fb67d34d1
Detects javaw.exe in AppData folder as used by Adwind / JRAT
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-25 · logsource: product=windows category=process_creation · 0f60b28c-64dd-4e2c-9a63-5334d3e3a6e6
Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks).
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.
Author: Sohan G (D4rkCiph3r), Red Canary (idea)
· 2023-08-22 · logsource: product=macos category=process_creation · 13db8d2e-7723-4c2c-93c1-a4d36994f7ef
Detects potential in-memory downloading and compiling of applets using curl and osacompile as seen used by XCSSET malware
Author: Michael Haag
· 2019-01-16 (modified 2026-02-17) · logsource: product=windows category=process_creation · 1e33157c-53b1-41ad-bbcc-780b80b58288
Detects script file execution (.js, .jse, .vba, .vbe, .vbs, .wsf, .wsh) by Wscript/Cscript.
Author: Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community
· 2017-11-10 (modified 2022-10-09) · logsource: product=windows category=process_creation · 1fac1481-2dbc-48b2-9096-753c49b4ec71
Detects javaw.exe in AppData folder as used by Adwind / JRAT
Author: Leonardo Gasparini
· 2026-05-12 · logsource: product=linux category=file_event · 2b5e4d3f-7c9a-4fab-a8d1-3e6f5a7b8c9d
Detects file creation indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai and uipath reported on early May 2026.
Author: @SBousseaden (detection), Thomas Patzke (rule)
· 2019-02-01 (modified 2023-05-05) · logsource: product=windows category=create_remote_thread · 2e4e488a-6164-4811-9ea1-f960c7359c40
Detects remote thread creation from CACTUSTORCH as described in references.
Author: Leonardo Gasparini
· 2026-05-12 · logsource: product=linux category=process_creation · 3c6f5e4a-8d0b-6abc-d9e2-4f7a6b8c9d0e
Detects process execution indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai and uipath reported on early May 2026.
The preinstall hook runs setup.mjs, which downloads a platform-specific Bun runtime.
Author: Pushkarev Dmitry
· 2020-06-28 (modified 2025-12-03) · logsource: product=windows service=applocker · 401e5d00-b944-11ea-8f9a-00163ecd60ae
Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.
Author: Maxim Pavlunin, Nasreddine Bencherchali (Nextron Systems)
· 2020-04-01 (modified 2023-04-12) · logsource: product=windows category=process_creation · 52cad028-0ff0-4854-8f67-d25dfcbc78b4
Detects a suspicious child process of a Microsoft HTML Help (HH.exe)
Author: heyyanu
· 2026-03-26 · logsource: product=windows service=applocker · 557e3bd3-7f21-495d-8d50-7c8bdfb8041c
Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.
Author: wagga, Jonhnathan Ribeiro, oscd.community
· 2020-01-12 (modified 2023-02-11) · logsource: product=windows category=process_creation · 5cddf373-ef00-4112-ad72-960ac29bac34
Detects command line parameters used by Koadic hack tool
Author: Josh Nickels, Michael Taggart
· 2025-05-22 · logsource: product=windows category=file_event · 6c0ce3b6-85e2-49d4-9c3f-6e008ce9796e
Detects Deno writing a file from a direct HTTP(s) call and writing to the appdata folder or bringing it's own malicious DLL.
This behavior may indicate an attempt to execute remotely hosted, potentially malicious files through deno.
Author: Microsoft (idea), Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-04-21 · logsource: product=windows category=process_creation · 8537c866-072e-460d-bfff-aaf39cbd73d3
Detects potentially suspicious inline JavaScript execution using Node.js with specific keywords in the command line.
Author: Leonardo Gasparini
· 2026-05-12 · logsource: product=windows category=file_event · 8a3f2c1e-5d7b-4e9a-b6c8-1f2a3d4e5f6a
Detects file creation indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai, uipath, etc reported on early May 2026.
Author: Markus Neis, Florian Roth, Swachchhanda Shrawan Poudel (Nextron Systems)
· 2019-01-16 (modified 2026-01-24) · logsource: product=windows category=process_creation · 8d63dadf-b91b-4187-87b6-34a1114577ea
Detects potential execution of the SquiblyTwo technique that leverages Windows Management Instrumentation (WMI)
to execute malicious code remotely. This technique bypasses application whitelisting by using wmic.exe to process
malicious XSL (eXtensible Stylesheet Language) scripts that can contain embedded JScript or VBScript.
The attack typically works by fetching XSL content from a remote source (using HTTP/HTTPS) and executing it
with full trust privileges directly in memory, avoiding disk-based detection mechanisms. This is a common
LOLBin (Living Off The Land Binary) technique used for defense evasion and code execution.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-05-15 (modified 2023-06-19) · logsource: product=windows category=process_creation · 99b7460d-c9f1-40d7-a316-1f36f61d52ee
Detects Wscript/Cscript executing a file with an uncommon (i.e. non-script) extension
Author: Leonardo Gasparini
· 2026-05-12 · logsource: product=windows category=process_creation · 9b4f3d2e-6e8c-5fab-c7d9-2a3b4e5f6a7b
Detects process execution indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai, uipath reported on early May 2026.
Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
· 2026-02-03 · logsource: product=windows category=process_creation · afa71271-6a97-4e47-810f-83120fb1a4ce
Detects the attempt to install new skills for AI agents using the "npx skills" command.
Agent skills enhance AI agents with new capabilities, but attackers may abuse this mechanism to inject malicious commands executed by the agent on behalf of the user.
The "npx skills" command can install skills for various agents (e.g., Claude Code, Cursor, and others).
Analysts should review any installed skills to verify their legitimacy.
Note: Tune this rule based on whether AI agent tooling is allowed in your environment.
In environments where such tooling is authorized, this detection may reflect normal activity and the alert level should be adjusted accordingly.
In environments where AI agent tooling is not permitted, this activity is likely suspicious and may require immediate investigation.
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
· 2019-02-11 (modified 2026-03-23) · logsource: product=windows category=process_creation · b730a276-6b63-41b8-bcf8-55930c8fc6ee
Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-04-21 · logsource: product=windows category=process_creation · ba3874b9-0fae-465f-836c-eb5d071a1789
Detects execution of JavaScript or JSC files using NodeJs binary node.exe, that could be potentially suspicious.
Node.js is a popular open-source JavaScript runtime that runs code outside browsers and is widely used for both frontend and backend development.
Adversaries have been observed abusing Node.js to disguise malware as legitimate processes, evade security defenses, and maintain persistence within target systems.
Because Node.js is commonly used, this rule may generate false positives in some environments. However, if such activity is unusual in your environment, it is highly suspicious and warrants immediate investigation.
Author: Diego Perez (@darkquassar), Markus Neis, Swisscom (Improve Rule), Swachchhanda Shrawan Poudel (Nextron Systems)
· 2019-02-22 (modified 2025-05-12) · logsource: product=windows category=process_creation · cc7abbd0-762b-41e3-8a26-57ad50d2eea3
Detects execution of mshta.exe with file types that looks like they do not typically represent HTA (HTML Application) content,
such as .png, .jpg, .zip, .pdf, and others, which are often polyglots. MSHTA is a legitimate Windows utility for executing HTML Applications
containing VBScript or JScript. Threat actors often abuse this lolbin utility to download and
execute malicious scripts disguised as benign files or hosted under misleading extensions to evade detection.
Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community, Nasreddine Bencherchali (Nextron Systems), Dave Johnson
· 2019-01-16 (modified 2026-02-17) · logsource: product=windows category=process_creation · cea72823-df4d-4567-950c-0b579eaf0846
Detects wscript/cscript/mshta executions of scripts located in user directories
Author: Max Altgelt (Nextron Systems)
· 2022-04-06 · logsource: product=windows category=process_creation · df1f26d3-bea7-4700-9ea2-ad3e990cf90e
Detects the execution of other scripts using the Node executable packaged with Adobe Creative Cloud
Author: Sohan G (D4rkCiph3r)
· 2023-02-18 · logsource: product=macos category=process_creation · e0cfaecd-602d-41af-988d-f6ccebb2af26
Detects the execution of suspicious child processes from macOS installer package parent process. This includes osascript, JXA, curl and wget amongst other interpreters
Author: Maxim Pavlunin
· 2020-04-01 (modified 2023-04-12) · logsource: product=windows category=process_creation · e8a95b5e-c891-46e2-b33a-93937d3abc31
Detects a suspicious execution of a Microsoft HTML Help (HH.exe)
Author: Sohan G (D4rkCiph3r)
· 2023-01-31 · logsource: product=macos category=process_creation · f1408a58-0e94-4165-b80a-da9f96cf6fc3
Detects possible malicious execution of JXA in-memory via OSAScript
Rules tagged at the parent level (attack.t1059) 95
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Sohan G (D4rkCiph3r)
· 2023-04-05 · logsource: product=macos category=process_creation · 0250638a-2b28-4541-86fc-ea4c558fa0c6
Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-04-17 · logsource: product=windows category=process_creation · 05ebafc8-7aa2-4bcd-a269-2aec93f9e842
Detects usage of winget to add new additional download sources
Author: Victor Sergeev, oscd.community
· 2020-10-09 (modified 2024-04-23) · logsource: product=windows category=process_creation · 06b401f4-107c-4ff9-947f-9ec1e7649f1e
Detects execution of "ftp.exe" script with the "-s" or "/s" flag and any child processes ran by "ftp.exe".
Author: Nasreddine Bencherchali (Nextron Systems), E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
· 2022-06-14 (modified 2023-01-04) · logsource: product=windows category=process_creation · 0955e4e1-c281-4fb9-9ee1-5ee7b4b754d2
Detects execition of commands and binaries from the context of The program compatibility assistant (Pcalua.exe). This can be used as a LOLBIN in order to bypass application whitelisting.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-25 · logsource: product=linux category=process_creation · 11bb9b26-4179-4a06-afcb-1ec31fce1627
Detects potential Shai-Hulud malware indicators based on specific command line arguments associated with its execution.
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2022-02-08 (modified 2026-02-17) · logsource: product=windows category=process_creation · 1228c958-e64e-4e71-92ad-7d429f4138ba
Detects suspicious script execution from suspicious directories or folders accessible by environment variables that may indicate malware activity.
Script interpreters (cscript, wscript, mshta, powershell) executing from folders like Temp, Public, or user profile directories may suggest attempts to evade detection or execute malicious scripts.
Author: Josh Nickels, Marius Rothenbücher
· 2024-09-06 · logsource: product=windows category=dns_query · 12310575-e8b1-475c-a976-57ed540b349c
Detects unusual domain resolutions originating from CScript/WScript that can identify malicious javascript files executing in an environment, often as a result from a phishing or watering hole attack.
Author: Florian Roth (Nextron Systems)
· 2021-11-20 (modified 2023-03-29) · logsource: product=windows category=file_event · 1277f594-a7d1-4f28-a2d3-73af5cbeab43
Detects Windows shells and scripting applications that write files to suspicious folders
Author: frack113, Tim Shelton (update fp)
· 2022-12-05 (modified 2025-03-06) · logsource: product=windows category=process_creation · 178e615d-e666-498b-9630-9ed363038101
Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a uncommon parent location.
Author: Micah Babinski
· 2023-10-15 · logsource: product=windows category=file_event · 1a433e1d-03d2-47a6-8063-ece992cf4e73
Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe.
This activity has been associated with DarkGate malware, which uses Autoit3.exe to execute shellcode that performs
process injection and connects to the DarkGate command-and-control server. Curl, KeyScramblerLogon, and these other
processes consitute non-standard and suspicious ways to retrieve the Autoit3 executable.
Author: Andreas Braathen (mnemonic.io)
· 2023-11-14 · logsource: product=windows category=process_creation · 1ddaa9a4-eb0b-4398-a9fe-7b018f9e23db
Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-01-02 · logsource: product=windows category=process_creation · 20a5ffa1-3848-4584-b6f8-c7c7fd9f69c8
Detects execution of ruby using the "-e" flag. This is could be used as a way to launch a reverse shell or execute live ruby code.
Author: Tim Rauch (rule), Elastic (idea)
· 2022-10-17 · logsource: product=macos category=process_creation · 234dc5df-40b5-49d1-bf53-0d44ce778eca
Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-06-14 · logsource: product=windows category=process_creation · 236d8e89-ed95-4789-a982-36f4643738ba
Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script that's located in a potentially suspicious location to run for a specific VM state
Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
· 2024-01-11 · logsource: product=windows category=process_creation · 2433a154-bb3d-42e4-86c3-a26bdac91c45
Detects the execution of a renamed "PingCastle" binary based on the PE metadata fields.
Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
· 2024-03-22 · logsource: product=windows category=process_creation · 24474469-bd80-46cc-9e08-9fbe81bfaaca
Detects the execution of a Word document via the WinWord Start Menu shortcut.
This behavior was observed being used by KamiKakaBot samples in order to initiate the 2nd stage of the infection.
Author: Florian Roth (Nextron Systems)
· 2017-05-31 (modified 2022-10-09) · logsource: product=windows service=security · 24549159-ac1b-479c-8175-d42aea947cae
This events that are generated when using the hacktool Ruler by Sensepost
Author: Bhabesh Raj
· 2021-09-08 (modified 2023-02-13) · logsource: product=windows category=process_creation · 245f92e3-c4da-45f1-9070-bc552e06db11
Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2021-26084
Author: Florian Roth (Nextron Systems), wagga
· 2020-12-23 (modified 2023-03-10) · logsource: product=windows category=process_creation · 24c4d154-05a4-4b99-b57d-9b977472443a
Detects different process execution behaviors as described in various threat reports on Lazarus group activity
Author: X__Junior (Nextron Systems)
· 2024-03-11 · logsource: product=windows category=process_creation · 264982dc-dbad-4dce-b707-1e0d3e0f73d9
Detects the execution of a renamed "NirCmd.exe" binary based on the PE metadata fields.
Author: Swachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali
· 2025-12-05 · logsource: product=windows category=process_creation · 271de298-cc0e-4842-acd8-079a0a99ea65
Detects suspicious child processes started by Node.js server processes on Windows, which may indicate exploitation of vulnerabilities like CVE-2025-55182 (React2Shell).
Attackers can abuse the Node.js 'child_process' module to run system commands or scripts using methods such as spawn(), exec(), execFile(), fork(), or execSync().
If execSync() or exec() is used in the exploit, the command line often shows a shell (e.g., cmd.exe /d /s /c ...) running a suspicious command unless other shells are explicitly invoked.
For other methods, the spawned process appears directly in the Image field unless a shell is explicitly used.
Author: Victor Sergeev, oscd.community
· 2020-10-09 (modified 2023-02-03) · logsource: product=windows category=process_creation · 277a4393-446c-449a-b0ed-7fdc7795244c
Detects the execution of a renamed "ftp.exe" binary based on the PE metadata fields
Author: Florian Roth
· 2025-01-18 · logsource: product=linux category=process_creation · 297241f3-8108-4b3a-8c15-2dda9f844594
Detects the execution of a shell as sub process of "rsync" without the expected command line flag "-e" being used, which could be an indication of exploitation as described in CVE-2024-12084. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-08-31 (modified 2023-05-15) · logsource: product=windows category=process_creation · 2c28c248-7f50-417a-9186-a85b223010ee
Detects the presence of the keywords "Wscript", "Shell" and "Run" in the command, which could indicate a suspicious activity
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
· 2024-09-02 · logsource: product=linux category=process_creation · 2d2f44ff-4611-4778-a8fc-323a0e9850cc
Detects execution of inline Python code via the "-c" in order to call the "system" function from the "os" library, and spawn a shell.
Author: Sreeman, Florian Roth (Nextron Systems), frack113
· 2020-04-21 (modified 2023-04-17) · logsource: product=windows category=process_creation · 313d6012-51a0-4d93-8dfc-de8553239e25
Detects usage of winget to install applications via manifest file. Adversaries can abuse winget to download payloads remotely and execute them.
The manifest option enables you to install an application by passing in a YAML file directly to the client.
Winget can be used to download and install exe, msi or msix files later.
Author: @kostastsale
· 2023-06-01 · logsource: product=windows category=process_creation · 39ac1fb0-07f1-474b-b97e-c5c0eace0d79
Detects the execution of "csc.exe" via "w3wp.exe" process. MOVEit affected hosts execute "csc.exe" via the "w3wp.exe" process to dynamically compile malicious DLL files.
MOVEit is affected by a critical vulnerability. Exploited hosts show evidence of dynamically compiling a DLL and writing it under C:\\Windows\\Microsoft\.NET\\Framework64\\v4\.0\.30319\\Temporary ASP\.NET Files\\root\\([a-z0-9]{5,12})\\([a-z0-9]{5,12})\\App_Web_[a-z0-9]{5,12}\.dll.
Hunting Opportunity
Events from IIS dynamically compiling binaries via the csc.exe on behalf of the MOVEit application, especially since May 27th should be investigated.
Author: Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)
· 2022-08-25 (modified 2023-03-05) · logsource: product=windows category=process_creation · 42333b2c-b425-441c-b70e-99404a17170f
Detects process activity patterns as seen being used by Sliver C2 framework implants
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
· 2024-09-02 · logsource: product=linux category=process_creation · 47b3bbd4-1bf7-48cc-84ab-995362aaa75a
Detects the use of the "git" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Author: Nextron Systems
· 2022-06-03 · logsource: product=windows category=process_creation · 480e7e51-e797-47e3-8d72-ebfce65b6d8d
Detects python spawning a pretty tty
Author: Tim Rauch, Elastic (idea)
· 2022-09-21 (modified 2023-12-05) · logsource: product=windows category=process_creation · 4b991083-3d0e-44ce-8fc4-b254025d8d4b
Detects suspicious parent process for cmd.exe
Author: @d4ns4n_
· 2023-04-24 · logsource: product=linux category=process_creation · 4e25af4b-246d-44ea-8563-e42aacab006b
Detects usage of "xterm" as a potential reverse shell tunnel
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-25 · logsource: product=windows category=process_creation · 540703fb-a874-4385-a9d6-7cd1bfab268c
Detects potential Shai-Hulud malware indicators based on specific command line arguments associated with its execution.
Author: Markus Neis, Nasreddine Bencherchali (Nextron Systems)
· 2018-12-27 (modified 2023-02-09) · logsource: product=windows category=process_creation · 55f0a3a1-846e-40eb-8273-677371b8d912
Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to run applications or execute macros
Author: bohops, Bhabesh Raj
· 2021-10-08 (modified 2023-07-25) · logsource: product=windows category=process_creation · 5687f942-867b-4578-ade7-1e341c46e99a
Detects suspicious child process creations of VMware Tools process which may indicate persistence setup
Author: Ján Trenčanský
· 2020-07-28 · logsource: product=windows service=windefend · 57b649ef-ff42-4fb0-8bf6-62da243a1708
Detects actions taken by Windows Defender malware detection engines
Author: Florian Roth (Nextron Systems)
· 2021-07-03 (modified 2022-05-20) · logsource: product=windows category=process_creation · 5de632bc-7fbd-4c8a-944a-fce55c59eae5
Detects process command line patterns and locations used by REvil group in Kaseya incident (can also match on other malware)
Author: Nasreddine Bencherchali (Nextron Systems), frack113
· 2023-11-23 (modified 2025-03-06) · logsource: product=windows category=process_creation · 61065c72-5d7d-44ef-bf41-6a36684b545f
Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges. Use this rule to hunt for potential suspicious processes.
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2022-02-25 (modified 2024-07-12) · logsource: product=windows category=process_creation · 69bd9b97-2be2-41b6-9816-fb08757a4d1a
Detects a potentially suspicious execution of a parent process located in the "\Users\Public" folder executing a child process containing references to shell or scripting binaries and commandlines.
Author: juju4
· 2019-01-16 (modified 2021-11-27) · logsource: product=windows category=process_creation · 6bba49bf-7f8c-47d6-a1bb-6b4dece4640e
Detects suspicious process related to rasdial.exe
Author: Tim Rauch (rule), Elastic (idea)
· 2022-10-21 (modified 2022-12-28) · logsource: product=macos category=process_creation · 6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4
Detects when the macOS Script Editor utility spawns an unusual child process.
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
· 2020-10-29 (modified 2022-10-09) · logsource: product=windows category=file_event · 6e90ae7a-7cd3-473f-a035-4ebb72d961da
Detects processes creating temp files related to PCRE.NET package
Author: Austin Songer
· 2021-09-21 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 72af37e2-ec32-47dc-992b-bc288a2708cb
Identifies when a new cloudshell is created inside of Azure portal.
Author: X__Junior (Nextron Systems)
· 2023-09-11 (modified 2023-10-12) · logsource: product=windows category=process_creation · 7530cd3d-7671-43e3-b209-976966f6ea48
Detects the execution of a renamed "CURL.exe" binary based on the PE metadata fields
Author: X__Junior (Nextron Systems)
· 2023-07-11 · logsource: product=windows category=image_load · 799a5f48-0ac1-4e0f-9152-71d137d48c2a
Detects potential DLL sideloading of DLLs that are known to be abused from suspicious locations
Author: pH-T (Nextron Systems)
· 2023-04-17 (modified 2024-11-23) · logsource: product=windows category=process_creation · 7a4d9232-92fc-404d-8ce1-4c92e7caf539
Detects Stracciatella which executes a Powershell runspace from within C# (aka SharpPick technique) with AMSI, ETW and Script Block Logging disabled based on PE metadata characteristics.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-06-14 · logsource: product=windows category=process_creation · 7aa4e81a-a65c-4e10-9f81-b200eb229d7d
Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script to run for a specific VM state
Author: @kostastsale
· 2023-07-16 · logsource: product=windows category=process_creation · 7aaa5739-12fc-41aa-b98b-23ec27d42bdf
Detects the redirection of Ursnif discovery commands as part of the initial execution of the malware.
Author: Nasreddine Bencherchali (Nextron Systems), Luc Génaux
· 2022-12-28 (modified 2026-06-05) · logsource: product=linux category=process_creation · 7ab8f73a-fcff-428b-84aa-6a5ff7877dea
Detects the use of "vim" and it's siblings commands to execute a shell or proxy commands.
Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Author: @d4ns4n_, Nasreddine Bencherchali (Nextron Systems)
· 2023-04-07 · logsource: product=linux category=process_creation · 7f734ed0-4f47-46c0-837f-6ee62505abd9
Detects execution of netcat with the "-e" flag followed by common shells. This could be a sign of a potential reverse shell setup.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-06-03 · logsource: product=linux category=process_creation · 7fb14105-530e-4e2e-8cfb-99f7d8700b66
Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2022-26134
Author: Rafal Piasecki
· 2022-08-10 (modified 2026-03-30) · logsource: product=linux service=auditd · 808146b2-9332-4d78-9416-d7e47012d83d
detects BPFDoor .lock and .pid files access in temporary file storage facility
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-06-16 · logsource: product=windows category=process_creation · 814c95cc-8192-4378-a70a-f1aafd877af1
Detects usage of OpenConsole binary as a LOLBIN to launch other binaries to bypass application Whitelisting
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-04-17 · logsource: product=windows category=process_creation · 81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2
Detects usage of winget to add a new insecure (http) download source.
Winget will not allow the addition of insecure sources, hence this could indicate potential suspicious activity (or typos)
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
· 2020-10-29 (modified 2022-10-09) · logsource: product=windows category=image_load · 84b0a8f3-680b-4096-a45b-e9a89221727c
Detects processes loading modules related to PCRE.NET package
Author: Florian Roth (Nextron Systems)
· 2022-03-24 (modified 2025-07-18) · logsource: product=windows category=process_creation · 85b0b087-eddf-4a2b-b033-d771fa2b9775
Detects PowerShell download and execution cradles.
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
· 2024-08-29 · logsource: product=linux category=process_creation · 8737b7f6-8df3-4bb7-b1da-06019b99b687
Detects the use of the "ssh" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Author: Florian Roth (Nextron Systems), @neonprimetime
· 2021-09-08 (modified 2023-02-04) · logsource: product=windows category=process_creation · 894397c6-da03-425c-a589-3d09e7d1f750
Detects potential exploitation of CVE-2021-40444 via suspicious process patterns seen in in-the-wild exploitations
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-01-02 (modified 2025-10-07) · logsource: product=windows category=process_creation · 899133d5-4d7c-4a7f-94ee-27355c879d90
Detects execution of python using the "-c" flag. This is could be used as a way to launch a reverse shell or execute live python code.
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
· 2024-09-02 · logsource: product=linux category=process_creation · 8c1a5675-cb85-452f-a298-b01b22a51856
Detects the execution of "awk" or it's sibling commands, to invoke a shell using the system() function.
This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.
Author: Micah Babinski
· 2025-11-25 · logsource: product=windows category=process_creation · 8e95e73e-ba02-4a87-b4d7-0929b8053038
Detects script interpreters, command-line tools, and similar suspicious child processes of ArcSOC.exe.
ArcSOC.exe is the process name which hosts ArcGIS Server REST services. If an attacker compromises an ArcGIS
Server system and uploads a malicious Server Object Extension (SOE), they can send crafted requests to the corresponding
service endpoint and remotely execute code from the ArcSOC.exe process.
Author: @kostastsale
· 2023-02-15 (modified 2024-08-13) · logsource: product=windows category=process_creation · 95724fc1-a258-4674-97db-a30351981c5a
This is a threat-hunting query to collect information related to the interactive execution of a script from inside a compressed file (zip/rar). Windows will automatically run the script using scripting interpreters such as wscript and cscript binaries.
From the query below, the child process is the script interpreter that will execute the script. The script extension is also a set of standard extensions that Windows OS recognizes. Selections 1-3 contain three different execution scenarios.
1. Compressed file opened using 7zip.
2. Compressed file opened using WinRar.
3. Compressed file opened using native windows File Explorer capabilities.
When the malicious script is double-clicked, it will be extracted to the respected directories as signified by the CommandLine on each of the three Selections. It will then be executed using the relevant script interpreter."
Author: Tim Rauch, Elastic, E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
· 2022-06-14 (modified 2024-03-05) · logsource: product=windows category=process_creation · 9aa5106d-bce3-4b13-86df-3a20f1d5cf0b
Detects the execution of "forfiles" with the "/c" flag.
While this is an expected behavior of the tool, it can be abused in order to proxy execution through it with any binary.
Can be used to bypass application whitelisting.
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
· 2022-02-15 (modified 2023-03-06) · logsource: product=windows category=process_creation · a77c1610-fc73-4019-8e29-0f51efc04a51
Detects possible payload obfuscation via the commandline
Author: Sreeman
· 2020-04-21 (modified 2022-03-08) · logsource: product=windows category=process_creation · ae9b0bd7-8888-4606-b444-0ed7410cb728
Monitors for the hiding possible malicious files in the C:\Windows\Fonts\ location. This folder doesn't require admin privillege to be written and executed from.
Author: X__Junior (Nextron Systems), Florian Roth (Nextron Systems)
· 2022-12-15 (modified 2024-01-02) · logsource: product=windows category=process_creation · afe52666-401e-4a02-b4ff-5d128990b8cb
Detects RAR usage that creates an archive from a suspicious folder, either a system folder or one of the folders often used by attackers for staging purposes
Author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
· 2022-06-02 (modified 2024-04-23) · logsource: product=windows category=process_creation · b96b2031-7c17-4473-afe7-a30ce714db29
Detects the execution of FSharp Interpreters "FsiAnyCpu.exe" and "FSi.exe"
Both can be used for AWL bypass and to execute F# code via scripts or inline.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-05-05 · logsource: product=windows category=file_event · bbb7e38c-0b41-4a11-b306-d2a457b7ac2b
Detects suspicious file based on their extension being created in "C:\PerfLogs\". Note that this directory mostly contains ".etl" files
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-12-02 (modified 2023-02-14) · logsource: product=windows category=process_creation · bdeeabc9-ff2a-4a51-be59-bb253aac7891
Detects usage of wsudo (Windows Sudo Utility). Which is a tool that let the user execute programs with different permissions (System, Trusted Installer, Administrator...etc)
Author: frack113, The DFIR Report
· 2022-03-02 (modified 2025-11-13) · logsource: product=windows category=process_creation · c0b2768a-dd06-4671-8339-b16ca8d1f27f
Detects the modification of NTFS symbolic link behavior using fsutil, which could be used to enable remote to local or remote to remote symlinks for potential attacks.
Author: Tim Rauch, Elastic (idea)
· 2022-09-16 (modified 2022-11-26) · logsource: product=windows category=ps_script · c1344fa2-323b-4d2e-9176-84b4d4821c88
Detects modifications to the Windows Defender configuration settings using PowerShell to add exclusions
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-04-17 (modified 2023-12-04) · logsource: product=windows category=process_creation · c15a46a0-07d4-4c87-b4b6-89207835a83b
Detects usage of winget to add new potentially suspicious download sources
Author: Nextron Systems
· 2022-06-03 (modified 2024-11-04) · logsource: product=linux category=process_creation · c4042d54-110d-45dd-a0e1-05c47822c937
Detects a python process calling to the PTY module in order to spawn a pretty tty which could be indicative of potential reverse shell activity.
Author: Markus Neis
· 2017-11-07 (modified 2022-10-09) · logsource: product=windows category=process_creation · c601f20d-570a-4cde-a7d6-e17f99cb8e7f
Detects automated lateral movement by Turla group
Author: Swachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali
· 2025-12-05 · logsource: product=linux category=process_creation · c70834fa-fb9d-4aa0-9e7d-45ceed36f3f7
Detects suspicious child processes spawned from Node.js server processes on Linux systems, potentially indicating remote code execution exploitation such as CVE-2025-55182 (React2Shell).
This rule particularly looks for exploitation of vulnerability on Node.js Servers where attackers abuse Node.js child_process module to execute arbitrary system commands.
When execSync() or exec() is used, the command line often includes a shell invocation followed by suspicious commands or scripts (e.g., /bin/sh -c <malicious-command>).
For other methods, the Image field will show the spawned process directly.
Author: Moriarty Meng (idea), Anton Kutepov (rule), oscd.community
· 2020-10-17 (modified 2021-11-27) · logsource: product=windows category=process_creation · c83bf4b5-cdf0-437c-90fa-43d734f7c476
Detects PowerShell script execution via input stream redirect
Author: Tim Rauch, Elastic (idea)
· 2022-09-28 (modified 2025-03-06) · logsource: product=windows category=process_creation · cbb9e3d1-2386-4e59-912e-62f1484f7a89
Detects when the Console Window Host (conhost.exe) process is spawned by an uncommon parent process, which could be indicative of potential code injection activity.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-06-03 · logsource: product=linux category=process_creation · d292e0af-9a18-420c-9525-ec0ac3936892
Detects java process spawning suspicious children
Author: Florian Roth (Nextron Systems)
· 2018-06-22 (modified 2021-11-27) · logsource: product=windows category=process_creation · d5b9ae7a-e6fc-405e-80ff-2ff9dcc64e7e
Detects suspicious sysprep process start with AppData folder as target (as used by Trojan Syndicasec in Thrip report by Symantec)
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-01-02 · logsource: product=windows category=process_creation · d81871ef-5738-47ab-9797-7a9c90cd4bfb
Detects execution of php using the "-r" flag. This is could be used as a way to launch a reverse shell or execute live php code.
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
· 2024-09-02 · logsource: product=linux category=process_creation · db1ac3be-f606-4e3a-89e0-9607cbe6b98a
Detects the use of the "capsh" utility to invoke a shell.
Author: Tomasz Dyduch, Josh Nickels
· 2024-05-31 · logsource: product=windows category=file_event · df49c691-8026-48dd-94d3-4ba6a79102a8
Detects attackers attempting to save, decrypt and execute the DarkGate Loader in C:\temp folder.
Author: Sohan G (D4rkCiph3r)
· 2023-02-18 · logsource: product=macos category=process_creation · e0cfaecd-602d-41af-988d-f6ccebb2af26
Detects the execution of suspicious child processes from macOS installer package parent process. This includes osascript, JXA, curl and wget amongst other interpreters
Author: Markus Neis, Nasreddine Bencherchali (Nextron Systems)
· 2018-12-27 (modified 2023-02-09) · logsource: product=windows category=process_creation · e212d415-0e93-435f-9e1a-f29005bb4723
Detects a suspicious child process spawning from Outlook where the image is located in a remote location (SMB/WebDav shares).
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Florian Roth
· 2024-09-02 (modified 2025-01-18) · logsource: product=linux category=process_creation · e2326866-609f-4015-aea9-7ec634e8aa04
Detects the use of the "rsync" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Author: Bhabesh Raj
· 2020-09-14 (modified 2022-12-07) · logsource: product=windows service=windefend · ea9bf0fa-edec-4fb8-8b78-b119f2528186
Detects triggering of AMSI by Windows Defender.
Author: Victor Sergeev, oscd.community
· 2020-10-09 (modified 2022-07-11) · logsource: product=windows category=process_creation · eca49c87-8a75-4f13-9c73-a5a29e845f03
Detects execution of powershell scripts via Runscripthelper.exe
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-10-10 · logsource: product=windows category=process_creation · eca8ae39-5c3c-4321-b538-9e64fe25822e
Detects installation of Kali Linux distribution through Windows Subsystem for Linux (WSL).
Attackers may use Kali Linux WSL to leverage its penetration testing tools and capabilities for malicious purposes.
Author: Florian Roth (Nextron Systems)
· 2022-02-11 (modified 2023-03-22) · logsource: product=windows category=process_creation · efdd8dd5-cee8-4e59-9390-7d4d5e4dd6f6
Detects suspicious patterns in program names or folders that are often found in malicious samples or hacktools
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2021-07-27 (modified 2023-03-29) · logsource: product=windows category=process_creation · f35c5d71-b489-4e22-a115-f003df287317
Detects potential process patterns related to Cobalt Strike beacon activity
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-01-02 · logsource: product=windows category=process_creation · f426547a-e0f7-441a-b63e-854ac5bdf54d
Detects execution of perl using the "-e"/"-E" flags. This is could be used as a way to launch a reverse shell or execute live perl code.
Author: Andreas Braathen (mnemonic.io)
· 2023-11-14 · logsource: product=linux category=process_creation · f8987c03-4290-4c96-870f-55e75ee377f4
Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.
Author: frack113
· 2022-03-12 · logsource: product=windows category=process_creation · f8ad2e2c-40b6-4117-84d7-20b89896ab23
Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system
Author: Micah Babinski
· 2023-10-15 · logsource: product=windows category=process_creation · f8e9aa1c-14f2-4dbd-aa59-b98968ed650d
Detects execution of the legitimate Autoit3 utility from a suspicious parent process. AutoIt3.exe is used within
the DarkGate infection chain to execute shellcode that performs process injection and connects to the DarkGate
command-and-control server.
Author: X__Junior
· 2025-01-20 · logsource: product=windows category=image_load · fb4e2211-6d08-426b-8e6f-0d4a161e3b1d
Detects Clfs.sys being loaded by a process running from a potentially suspicious location. Clfs.sys is loaded as part of many CVEs exploits that targets Common Log File.