Skip to content

Hide Navigation Hide TOC

Potential Reconnaissance Activity Via GatherNetworkInfo.VBS (575dce0c-8139-4e30-9295-1ee75969f7fe)

Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine

Cluster A Galaxy A Cluster B Galaxy B Level
Group Policy Discovery - T1615 (1b20efbf-8063-4fc3-a07d-b575318a301b) Attack Pattern Potential Reconnaissance Activity Via GatherNetworkInfo.VBS (575dce0c-8139-4e30-9295-1ee75969f7fe) Sigma-Rules 1
Potential Reconnaissance Activity Via GatherNetworkInfo.VBS (575dce0c-8139-4e30-9295-1ee75969f7fe) Sigma-Rules Visual Basic - T1059.005 (dfd7cc1d-e1d8-4394-a198-97c4cab8aa67) Attack Pattern 1
Visual Basic - T1059.005 (dfd7cc1d-e1d8-4394-a198-97c4cab8aa67) Attack Pattern Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830) Attack Pattern 2