detect-jscript-file-creation

Description

This query was originally published in the threat analytics report, Emulation-evading JavaScripts. Attackers in several ransomware campaigns have employed heavily obfuscated JavaScript code, in order to implant malware or execute malicious commands. The obfuscation is intended to help the code evade security systems and potentially escape sandbox environments. The following query detects the creation of files with a .jse extension. Certain ransomware campaigns, such as Emotet, are known to employ encrypted JavaScript code that is saved to the target as .jse files. See Detect potentially malicious .jse launch by File Explorer or Word for a similar technique. Reference - https://www.microsoft.com/security/blog/2017/11/06/mitigating-and-eliminating-info-stealing-qakbot-and-emotet-in-corporate-networks/

Query · kql

// Creation of any .jse file, including legitimate and malicious ones 
DeviceFileEvents 
| where Timestamp > ago(7d)
| where FileName endswith ".jse"
Raw source detect-jscript-file-creation · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 7913cb78-0e5a-4c4c-ab5b-31ef823ba25b
name: detect-jscript-file-creation
description: |
  This query was originally published in the threat analytics report, Emulation-evading JavaScripts.
  Attackers in several ransomware campaigns have employed heavily obfuscated JavaScript code, in order to implant malware or execute malicious commands. The obfuscation is intended to help the code evade security systems and potentially escape sandbox environments.
  The following query detects the creation of files with a .jse extension. Certain ransomware campaigns, such as Emotet, are known to employ encrypted JavaScript code that is saved to the target as .jse files.
  See Detect potentially malicious .jse launch by File Explorer or Word for a similar technique.
  Reference - https://www.microsoft.com/security/blog/2017/11/06/mitigating-and-eliminating-info-stealing-qakbot-and-emotet-in-corporate-networks/
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceFileEvents
tactics:
- Execution
- Defense evasion
query: |
  // Creation of any .jse file, including legitimate and malicious ones 
  DeviceFileEvents 
  | where Timestamp > ago(7d)
  | where FileName endswith ".jse"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.