Legitimate Application Dropped Script

 1title: Legitimate Application Dropped Script
 2id: 7d604714-e071-49ff-8726-edeb95a70679
 3status: experimental
 4description: Detects programs on a Windows system that should not write scripts to disk
 5references:
 6    - https://github.com/Neo23x0/sysmon-config/blob/3f808d9c022c507aae21a9346afba4a59dd533b9/sysmonconfig-export-block.xml#L1326
 7author: frack113, Florian Roth (Nextron Systems)
 8date: 2022/08/21
 9modified: 2023/06/22
10tags:
11    - attack.defense_evasion
12    - attack.t1218
13logsource:
14    product: windows
15    category: file_event
16detection:
17    selection:
18        Image|endswith:
19            # Microsoft Office Programs Dropping Executables / Rest of the apps are covered in: c7a74c80-ba5a-486e-9974-ab9e682bc5e4
20            - \eqnedt32.exe
21            - \wordpad.exe
22            - \wordview.exe
23            # LOLBINs that can be used to download executables
24            - \certutil.exe
25            - \certoc.exe
26            - \CertReq.exe
27            # - \bitsadmin.exe (depends on the environment; comment in if you're sure that bitsadmin doesn't do that in your env)
28            - \Desktopimgdownldr.exe
29            - \esentutl.exe
30            # - \expand.exe
31            - '\mshta.exe'
32            # Executables that should never drop an executable to disk (but may after a previous process injection or if it's malware that uses a legitimate name)
33            - '\AcroRd32.exe'
34            - '\RdrCEF.exe'
35            - '\hh.exe'
36            - '\finger.exe'
37        TargetFilename|endswith:
38            - '.ps1'
39            - '.bat'
40            - '.vbs'
41            - '.scf'
42            - '.wsf'
43            - '.wsh'
44    condition: selection
45falsepositives:
46    - Unknown
47level: high