Cross-source coverage

T1059.005 / ATT&CK

Command and Scripting Interpreter: Visual Basic

109 rules across 6 sources.

From MITRE ATT&CK 19.2

Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows technologies such as Component Object Model and the Native API through the Windows API. Although tagged as legacy with no planned future evolutions, VB is integrated and supported in the.NET Framework and cross-platform.NET Core.

Derivative languages based on VB have also been created, such as Visual Basic for Applications (VBA) and VBScript. VBA is an event-driven programming language built into Microsoft Office, as well as several third-party applications. VBA enables documents to contain macros used to automate the execution of tasks and other functionality on the host. VBScript is a default scripting language on Windows hosts and can also be used in place of JavaScript on HTML Application (HTA) webpages served to Internet Explorer (though most modern browsers do not come with VBScript support).

Adversaries may use VB payloads to execute malicious commands. Common malicious usage includes automating execution of behaviors with VBScript or embedding VBA content into Spearphishing Attachment payloads (which may also involve Mark-of-the-Web Bypass to enable execution).

Tactics: Execution
Platforms: Linux · macOS · Windows
Telemetry: WinEventLog:Sysmonmacos:unifiedlogmacos:osquerymacos:syslogauditd:SYSCALLlinux:syslog

How MITRE says to detect it DET0076

Behavioral Detection of Visual Basic Execution (VBS/VBA/VBScript)

Windows Analytic 0209

Detects execution of VB-based scripts or macros (VBS/VBA/VBScript) through cscript.exe/wscript.exe, Office-based process chains, or HTA usage. Focuses on chained behavior: Office or HTML container spawns script host > script host spawns PowerShell, network connections, or process injection.

WinEventLog:Sysmon EventCode=1
WinEventLog:Sysmon EventCode=7

macOS Analytic 0210

Detects embedded or emulated VBScript/VBA execution via Wine-based apps, Office for Mac abusing cross-platform.NET features, or macros dropped and invoked via AppleScript or third-party automation tools.

macos:unifiedlog log stream --predicate 'eventMessage contains "wscript" OR "vbs"'
macos:osquery process_events
macos:syslog system.log

Linux Analytic 0211

Detects abuse of Mono/.NET Core environments to execute VB-like scripts, often in environments with Office emulation or WINE. Focus is on rare invocations of scripting hosts like mono.exe or.NET shells, often seen in spam filtering or forensic labs with Office support.

auditd:SYSCALL execve
linux:syslog /var/log/syslog

View on attack.mitre.org ↗

elastic/protections-artifacts

49 rules

Detection	Severity	Format
Dynwrapx Image Load via Windows Scripts	Undefined	Elastic TOML
Execution from Unusual Directory	Undefined	Elastic TOML
Execution from ZIP File via Explorer	Undefined	Elastic TOML
Execution of a Downloaded Windows Script via Explorer	Undefined	Elastic TOML
Execution of a File Downloaded via Windows OpenSSH	Undefined	Elastic TOML
Execution of a File Written by Windows Script Host	Undefined	Elastic TOML
Execution of a Windows Script Downloaded from the Internet	Undefined	Elastic TOML
Execution of a Windows Script Downloaded via a LOLBIN	Undefined	Elastic TOML
Execution of a Windows Script File Written by a Suspicious Process	Undefined	Elastic TOML
Execution of a Windows Script with Unusual File Extension	Undefined	Elastic TOML

+ 39 more from elastic/protections-artifacts → showing the 10 highest-severity

SigmaHQ/sigma

29 rules

Detection	Severity	Format
Potential QBot Activity	Critical	Sigma
Adwind RAT / JRAT	High	Sigma
Adwind RAT / JRAT File Artifact	High	Sigma
Axios NPM Compromise Indicators - Windows	High	Sigma
Csc.EXE Execution Form Potentially Suspicious Parent	High	Sigma
Cscript/Wscript Uncommon Script Extension Execution	High	Sigma
HackTool - CACTUSTORCH Remote Thread Creation	High	Sigma
HackTool - Koadic Execution	High	Sigma
HackTool - NetExec File Indicators	High	Sigma
HTML Help HH.EXE Suspicious Child Process	High	Sigma

+ 19 more from SigmaHQ/sigma → showing the 10 highest-severity

elastic/detection-rules

18 rules

Detection	Severity	Format
Command and Scripting Interpreter via Windows Scripts	High	Elastic TOML
Script Execution via Microsoft HTML Application	High	Elastic TOML
Web Shell Detection: Script Process Child of Common Web Processes	High	Elastic TOML
Execution of a Downloaded Windows Script	Medium	Elastic TOML
Microsoft Build Engine Started by a Script Process	Medium	Elastic TOML
Microsoft Management Console File from Unusual Path	Medium	Elastic TOML
Remote File Download via Script Interpreter	Medium	Elastic TOML
Scheduled Task Created by a Windows Script	Medium	Elastic TOML
Script Interpreter Connection to Non-Standard Port	Medium	Elastic TOML
Suspicious Explorer Child Process	Medium	Elastic TOML

+ 8 more from elastic/detection-rules → showing the 10 highest-severity

splunk/security_content

7 rules

Detection	Severity	Format
Cisco NVM - MSHTML or MSHTA Network Execution Without URL in CLI	Undefined	SPL
Cisco NVM - Susp Script From Archive Triggering Network Activity	Undefined	SPL
Execute Javascript With Jscript COM CLSID	Undefined	SPL
Suspicious Process DNS Query Known Abuse Web Services	Undefined	SPL
Suspicious Process With Discord DNS Query	Undefined	SPL
Vbscript Execution Using Wscript App	Undefined	SPL
Windows Outlook Macro Created by Suspicious Process	Undefined	SPL

Wazuh Core Ruleset

3 rules

Detection	Severity	Format
Executed a renamed copy of wscript.exe	High	Wazuh XML
Office application loaded vbeui.dll module. May be used to execute scripting code	High	Wazuh XML
Scripting interpreter spawned a new process	Low	Wazuh XML

socfortress/Wazuh-Rules

3 rules

Detection	Severity	Format
Sysmon - Event 1: Process creation · VBScript HTA Execution (T1059.005)	High	Wazuh XML
Sysmon - Event 1: Process creation · VBScript via CScript/WScript (T1059.005)	High	Wazuh XML
Sysmon - Event 1: Process creation · VBScript via WScript (T1059.005)	High	Wazuh XML