.NET COM object created in non-standard Windows Script Interpreter

[rule]
description = """
Identifies the creation of a .NET COM object in an unexpected Windows script interpreter. Adversaries may utilise .NET
to call arbitrary Win32 APIs from scripts.
"""
id = "1e9ac3fe-edb4-d669-71ab-220acc092982"
license = "Elastic License v2"
name = ".NET COM object created in non-standard Windows Script Interpreter"
os_list = ["windows"]
reference = ["https://github.com/tyranid/DotNetToJScript"]
version = "1.0.11"

query = '''
api where
  not process.name : ("cscript.exe", "wscript.exe") and
  process.code_signature.trusted == true and
  process.code_signature.subject_name like "Microsoft*" and
  process.Ext.api.name == "VirtualAlloc" and
  process.Ext.api.parameters.allocation_type == "RESERVE" and
  process.Ext.api.parameters.protection == "RWX" and
  process.thread.Ext.call_stack_summary like (
    /* .NET is allocating executable memory on behalf of a WSH script engine
     * Note - this covers both .NET 2 and .NET 4 framework variants */
    "*|mscoree.dll|combase.dll|jscript.dll|*",
    "*|mscoree.dll|combase.dll|vbscript.dll|*",
    /* These aren't WSH script engines - but the technique is likely still valid */
    "*|mscoree.dll|combase.dll|jscript9.dll|*",
    "*|mscoree.dll|combase.dll|chakra.dll|*"
) and

process.parent.executable != null and

not (process.executable : "?:\\Windows\\SysWOW64\\msiexec.exe" and 
     process.parent.executable : "?:\\Windows\\System32\\msiexec.exe" and 
     process.thread.Ext.call_stack_summary like "*|mscoree.dll|combase.dll|vbscript.dll|*|rpcrt4.dll|*") and

not (process.name : "mshta.exe" and 
     process.parent.executable : ("?:\\Program Files (x86)\\Amazon\\Amazon Assistant\\amazonAssistantService.exe", 
                                  "?:\\Program Files\\Microsoft Configuration Manager\\AdminConsole\\bin\\Microsoft.ConfigurationManagement.exe",
                                  "?:\\Program Files\\Bentley\\*.exe")) and 

not (process.executable : "?:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" and 
     process.parent.executable : "?:\\Program Files\\Internet Explorer\\iexplore.exe" and
     process.thread.Ext.call_stack_summary like "*|combase.dll|jscript9.dll|*") and

/* ASP VBScript (System32 + SysWOW64 w3wp) */
not (process.Ext.api.name == "VirtualAlloc" and 
     process.executable : ("?:\\Windows\\System32\\inetsrv\\w3wp.exe", "?:\\Windows\\SysWOW64\\inetsrv\\w3wp.exe") and
     process.thread.Ext.call_stack_summary like "*|mscoree.dll|combase.dll|vbscript.dll|asp.dll|comsvcs.dll|*") and

/* JumpCloud */
not (process.executable : "?:\\Windows\\System32\\LogonUI.exe" and
     process.thread.Ext.call_stack_summary like "*|vbscript.dll|*" and
     not process.thread.Ext.call_stack_summary like "*Unbacked*") and

not (process.command_line : "\"mshta.exe\" \"C:\\Program Files (x86)\\Amazon\\Amazon Assistant\\aa.hta\"" and
    process.parent.executable : "C:\\Program Files (x86)\\Amazon\\Amazon Assistant\\amazonAssistantService.exe") and

not (process.executable : "?:\\Program Files\\Microsoft SQL Server\\*\\DTS\\Binn\\DTExec.exe" and
     process.parent.executable : "?:\\Program Files\\Microsoft SQL Server\\*\\MSSQL\\Binn\\SQLAGENT.EXE") and

not (process.executable : "C:\\Program Files\\Microsoft Office\\root\\Office??\\OUTLOOK.EXE" and
     process.thread.Ext.call_stack_summary like "*combase.dll|vbscript.dll|mso30win32client.dll*") and
not (process.executable : "C:\\Windows\\System32\\CredentialUIBroker.exe" and
     process.parent.executable : "C:\\Windows\\System32\\svchost.exe" and
     process.thread.Ext.call_stack_summary == "ntdll.dll|kernelbase.dll|clr.dll|mscoreei.dll|mscoree.dll|combase.dll|jscript.dll|kernel32.dll|ntdll.dll") and
not (process.executable : "C:\\Windows\\System32\\SearchFilterHost.exe" and process.parent.executable : "C:\\Windows\\System32\\SearchIndexer.exe" and
     process.thread.Ext.call_stack_summary : "ntdll.dll*|kernelbase.dll|clr.dll|mscoreei.dll|mscoree.dll|combase.dll|*|offfiltx.dll|*|rpcrt4.dll|combase.dll|rpcrt4.dll|ntdll.dll|kernel32.dll|ntdll.dll")
'''

min_endpoint_version = "8.8.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.005"
name = "Visual Basic"
reference = "https://attack.mitre.org/techniques/T1059/005/"

[[threat.technique.subtechnique]]
id = "T1059.007"
name = "JavaScript"
reference = "https://attack.mitre.org/techniques/T1059/007/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.8.0"