WScript Launched By Powershell

 1title: WScript Launched By Powershell
 2status: experimental
 3description: powershell launches WScript, WScript executes file from startup
 4author: Joe Security
 5date: 2019-10-21
 6id: 200004
 7threatname:
 8behaviorgroup: 1
 9classification: 5
10mitreattack:
11
12logsource:
13    category: process_creation
14    product: windows
15detection:
16    selection:
17        ParentCommandLine: '*\powershell.exe*'
18        CommandLine:
19            -'*\WScript.exe*\appdata\roaming\microsoft\word\startup\\*'
20    condition: selection
21level: critical