Skip to content

Hide Navigation Hide TOC

Cscript/Wscript Uncommon Script Extension Execution (99b7460d-c9f1-40d7-a316-1f36f61d52ee)

Detects Wscript/Cscript executing a file with an uncommon (i.e. non-script) extension

Cluster A Galaxy A Cluster B Galaxy B Level
JavaScript - T1059.007 (0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d) Attack Pattern Cscript/Wscript Uncommon Script Extension Execution (99b7460d-c9f1-40d7-a316-1f36f61d52ee) Sigma-Rules 1
Cscript/Wscript Uncommon Script Extension Execution (99b7460d-c9f1-40d7-a316-1f36f61d52ee) Sigma-Rules Visual Basic - T1059.005 (dfd7cc1d-e1d8-4394-a198-97c4cab8aa67) Attack Pattern 1
JavaScript - T1059.007 (0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d) Attack Pattern Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830) Attack Pattern 2
Visual Basic - T1059.005 (dfd7cc1d-e1d8-4394-a198-97c4cab8aa67) Attack Pattern Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830) Attack Pattern 2