jse-launched-by-word

id: da127884-b65b-4ccf-b178-320d9cac3e15
name: jse-launched-by-word
description: |
  This query was originally published in the threat analytics report, Emulation-evading JavaScripts.
  Attackers in several ransomware campaigns have employed heavily obfuscated JavaScript code, in order to implant malware or execute malicious commands. The obfuscation is intended to help the code evade security systems and potentially escape sandbox environments.
  The following query detects when Word or File Explorer have launched files with a .jse extension. Attackers involved in various human-operated campaigns have been known to embed a heavily obfuscated JavaScript file in malicious Word docs. The loader is used to download and install the banking trojan, Trickbot.
  See Detect .jse file creation events for a similar technique.
  Reference - https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Initial access
- Execution
- Defense evasion
query: |
  // Find potentially malicious .jse launch by File Explorer or Word 
  DeviceProcessEvents 
  | where Timestamp > ago(7d) 
  | where InitiatingProcessFileName in~ ("explorer.exe","winword.exe") 
  and FileName =~ "wscript.exe"
  and ProcessCommandLine contains ".jse"