Suspicious PowerShell Execution via Windows Scripts
Description
Identifies suspicious PowerShell execution spawning from Windows Script Host processes (cscript or wscript.exe).
Query · eql
process where event.action == "start" and
(process.name : ("powershell.exe", "pwsh.exe") or process.pe.original_file_name : ("powershell.exe", "pwsh.exe")) and
(
process.parent.name : ("wscript.exe", "mshta.exe") or
(process.parent.name : "node.exe" and process.working_directory : ("?:\\Users\\*\\Downloads\\*", "?:\\Users\\*\\Desktop\\*", "?:\\Users\\*\\appdata\\*")) or
(descendant of [process where event.action == "start" and process.name : ("wscript.exe", "mshta.exe")] and
not process.parent.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe"))
) and
(
process.args_count == 1 or
process.command_line :
("*^*^*^*^*^*^*^*^*^*",
"*''*''*''*",
"*`*`*`*`*",
"*{*{*{*{*{*{*{*{*{*{*{*{*{*{*{*{*{*{*{*",
"*+*+*+*+*+*",
"*$*$*$*$*",
"*[char[]](*)*-join",
"*Base64String*",
"*[*Convert]*",
"*.Text.Encoding*",
"*.Compression.*",
"*.replace(*",
"*MemoryStream*",
"*WriteAllBytes*",
"* -en* *",
"* -ec *",
"* -e *",
"* -ep *",
"* /e *",
"* /en* *",
"* /ec *",
"* /ep *",
"*WebClient*",
"*DownloadFile*",
"*DownloadString*",
"*BitsTransfer*",
"*Invoke-Exp*",
"*invoke-web*",
"*Invoke-RestMethod*",
"*iex*",
"*iwr*",
"*Reflection.Assembly*",
"*Assembly.GetType*",
"*.Sockets.*",
"*Add-MpPreference*ExclusionPath*",
"*raw.githubusercontent*")
) and
/* false positives */
not process.parent.name: ("gc_worker.exe", "gc_service.exe") and
not process.parent.command_line : "*Windows\\TEMP\\nessus_*" and
/* Issue #247 */
not process.parent.executable :
("?:\\Windows\\System32\\svchost.exe",
"?:\\Windows\\System32\\CompatTelRunner.exe",
"?:\\Windows\\System32\\taskeng.exe") and
not process.parent.executable : "C:\\FVS\\FVSSoftware\\*\\bin\\x64\\Rscript.exe" and
not process.Ext.token.integrity_level_name == "system" and
/* many legit powershell commands uses those non shortened execution flags excluding Sync-AppvPublishingServer lolbas */
not (process.args : ("-EncodedCommand", "Import-Module*", "-NonInteractive") and
process.args : "-ExecutionPolicy" and not process.args : "Sync-AppvPublishingServer") and
/* third party installation related FPs */
not process.parent.args : "?:\\Windows\\system32\\gatherNetworkInfo.vbs" and
not (process.parent.args : "Microsoft.SystemCenter.ICMPProbe.WithConsecutiveSamples.vbs" and process.args : "Get-SCOMAgent") and
not (process.command_line : "*WEBLOGIC_ARGS_CURRENT_1.DATA*" and process.parent.command_line : "*Impact360*") and
not process.args : "$package = Get-AppxPackage Microsoft.Office.Desktop -allUsers;*" and
not process.command_line : ("*.Access.IdentityReference*win32_SID.SID*", "*AGIAbQB4AC0AYQBwAC4AcwAzAC4AdQBzAC0AZQBhAHMAd*") and
not (process.parent.args : "?:\\Users\\Prestige\\AppData\\Local\\Temp\\Rar$*\\KMS_VL_ALL_AIO.cmd -elevated" and process.command_line : "*KMS_VL_ALL_AIO.cmd*") and
not (process.parent.name : "cmd.exe" and
process.parent.command_line : "*C:\\Program Files\\CheckPoint\\Harmony Connect\\resources\\build\\installation_scripts\\on_install\\on_install.bat*") and
not process.args : "iwr https://*.s3.us-east-1.amazonaws.com/scripts/Start-SpeedTest.ps1 -UserAgent * -UseBasicParsing | invoke-expression" and
not (process.parent.name : "wscript.exe" and
process.parent.args : "C:\\Program Files (x86)\\Telivy\\Telivy Agent\\telivy.js") and
not process.command_line : "c:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -executionpolicy bypass -WindowStyle Hidden -Command \"powershell.exe -executionpolicy bypass -WindowStyle Hidden -Command \\\"iwr bmx-panels-check.s3.us-east-1.amazonaws.com/scripts/Set-BMXFirewallPolicy.ps1 -UserAgent MzEyYTdjNzg1ZWI3 -UseBasicParsing | invoke-expression\\\"\"" and
not (process.parent.name : "cmd.exe" and process.parent.args : "\\\\*\\netlogon\\*" and process.args : "\\\\*\\netlogon\\*.ps1") and
not process.args : "C:\\Program Files\\Common Files\\EETI\\TouchModeXML\\RunRegisterAllUserTask.ps1" and
not (process.parent.name: "cmd.exe" and process.args : ("C:\\PreVeil\\filesync\\PreVeil_Client", "C:\\ProgramData\\recycle\\ISO\\recycle.ps1")) and
not (process.parent.command_line : "wscript //B checkschedule.wsf /baseUrl:https://utilities.pcpitstop.com") and
not (process.parent.name : "cmd.exe" and
process.parent.args : ("C:\\Users\\*\\AppData\\Local\\Temp\\DONDA-NetworkInfo-*.bat ",
"C:\\ProgramData\\Hays\\WallpaperRefresh\\SilentExecute.bat ",
"Files\\Tyco\\SiteServer\\TSP.ISS.WindowsServices.Host\\Command\\ComputerNameScripts\\toolbar.cmd ",
"Files\\Tyco\\SiteServer\\TSP.ISS.WindowsServices.Host\\Command\\ComputerNameScripts\\start.cmd ")) and
/* developer and AI coding tools spawning PowerShell for system queries */
not (
(
(process.parent.name : "node.exe" and
process.parent.code_signature.subject_name : "OpenJS Foundation") or
(process.parent.name : "claude.exe" and
process.parent.code_signature.subject_name : "Anthropic, PBC") or
(process.parent.name : "codex.exe" and
process.parent.code_signature.subject_name : "OpenAI OpCo, LLC")
) and
process.parent.code_signature.trusted == true)