attack.t1059.005

Axios NPM Compromise Indicators - Windows

Apr 28, 2026 · attack.initial-access attack.t1195.002 attack.execution attack.command-and-control attack.t1059.003 attack.t1059.005 attack.t1105 detection.emerging-threats ·

Share on:

Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper. The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection. The attack used cscript.exe (VBScript), curl.exe (C2), and PowerShell masquerading as Windows Terminal.

Csc.EXE Execution Form Potentially Suspicious Parent

Apr 28, 2026 · attack.execution attack.stealth attack.t1059.005 attack.t1059.007 attack.t1218.005 attack.t1027.004 ·

Share on:

Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.

HackTool - CACTUSTORCH Remote Thread Creation

Apr 28, 2026 · attack.privilege-escalation attack.execution attack.stealth attack.t1055.012 attack.t1059.005 attack.t1059.007 attack.t1218.005 ·

Share on:

Detects remote thread creation from CACTUSTORCH as described in references.

HTML Help HH.EXE Suspicious Child Process

Apr 28, 2026 · attack.execution attack.initial-access attack.stealth attack.t1047 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.007 attack.t1218 attack.t1218.001 attack.t1218.010 attack.t1218.011 attack.t1566 attack.t1566.001 ·

Share on:

Detects a suspicious child process of a Microsoft HTML Help (HH.exe)

MMC Loading Script Engines DLLs

Apr 28, 2026 · attack.execution attack.stealth attack.t1059.005 attack.t1218.014 ·

Share on:

Detects when the Microsoft Management Console (MMC) loads the DLL libraries like vbscript, jscript etc which might indicate an attempt to execute malicious scripts within a trusted system process for bypassing application whitelisting or defense evasion.

Potential Remote SquiblyTwo Technique Execution

Apr 28, 2026 · attack.stealth attack.t1047 attack.t1220 attack.execution attack.t1059.005 attack.t1059.007 ·

Share on:

Detects potential execution of the SquiblyTwo technique that leverages Windows Management Instrumentation (WMI) to execute malicious code remotely. This technique bypasses application whitelisting by using wmic.exe to process malicious XSL (eXtensible Stylesheet Language) scripts that can contain embedded JScript or VBScript. The attack typically works by fetching XSL content from a remote source (using HTTP/HTTPS) and executing it with full trust privileges directly in memory, avoiding disk-based detection mechanisms. This is a common LOLBin (Living Off The Land Binary) technique used for defense evasion and code execution.

Registry Modification Attempt Via VBScript

Apr 28, 2026 · attack.persistence attack.execution attack.defense-impairment attack.t1112 attack.t1059.005 ·

Share on:

Detects attempts to modify the registry using VBScript's CreateObject("Wscript.shell") and RegWrite methods via common LOLBINs. It could be an attempt to modify the registry for persistence without using straightforward methods like regedit.exe, reg.exe, or PowerShell. Threat Actors may use this technique to evade detection by security solutions that monitor for direct registry modifications through traditional tools.

Registry Modification Attempt Via VBScript - PowerShell

Apr 28, 2026 · attack.persistence attack.execution attack.defense-impairment attack.t1112 attack.t1059.005 ·

Share on:

Detects attempts to modify the registry using VBScript's CreateObject("Wscript.shell") and RegWrite methods embedded within PowerShell scripts or commands. Threat actors commonly embed VBScript code within PowerShell to perform registry modifications, attempting to evade detection that monitors for direct registry access through traditional tools. This technique can be used for persistence, defense evasion, and privilege escalation by modifying registry keys without using regedit.exe, reg.exe, or PowerShell's native registry cmdlets.

Registry Tampering by Potentially Suspicious Processes

Apr 28, 2026 · attack.persistence attack.execution attack.defense-impairment attack.t1112 attack.t1059.005 ·

Share on:

Detects suspicious registry modifications made by suspicious processes such as script engine processes such as WScript, or CScript etc. These processes are rarely used for legitimate registry modifications, and their activity may indicate an attempt to modify the registry without using standard tools like regedit.exe or reg.exe, potentially for evasion and persistence.

Suspicious Child Process Of BgInfo.EXE

Apr 28, 2026 · attack.execution attack.stealth attack.t1059.005 attack.t1218 attack.t1202 ·

Share on:

Detects suspicious child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript

Suspicious HH.EXE Execution

Apr 28, 2026 · attack.execution attack.initial-access attack.stealth attack.t1047 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.007 attack.t1218 attack.t1218.001 attack.t1218.010 attack.t1218.011 attack.t1566 attack.t1566.001 ·

Share on:

Detects a suspicious execution of a Microsoft HTML Help (HH.exe)

Uncommon Child Process Of BgInfo.EXE

Apr 28, 2026 · attack.execution attack.stealth attack.t1059.005 attack.t1218 attack.t1202 ·

Share on:

Detects uncommon child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript

Windows Shell/Scripting Processes Spawning Suspicious Programs

Apr 28, 2026 · attack.execution attack.stealth attack.t1059.005 attack.t1059.001 attack.t1218 ·

Share on:

Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, mshta...etc.

XSL Script Execution Via WMIC.EXE

Apr 28, 2026 · attack.stealth attack.t1047 attack.t1220 attack.execution attack.t1059.005 attack.t1059.007 ·

Share on:

Detects the execution of WMIC with the "format" flag to potentially load local XSL files. Adversaries abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses. Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files.

Potential Dropper Script Execution Via WScript/CScript/MSHTA

Apr 27, 2026 · attack.execution attack.t1059.005 attack.t1059.007 ·

Share on:

Detects wscript/cscript/mshta executions of scripts located in user directories

WScript or CScript Dropper - File

Apr 27, 2026 · attack.execution attack.t1059.005 attack.t1059.007 ·

Share on:

Detects a file ending in jse, vbe, js, vba, vbs, wsf, wsh written by cscript.exe or wscript.exe

HackTool - NetExec File Indicators

Apr 23, 2026 · attack.execution attack.lateral-movement attack.discovery attack.t1021.002 attack.t1059.005 ·

Share on:

Detects file creation events indicating NetExec (nxc.exe) execution on the local machine. NetExec is a PyInstaller-bundled binary that extracts its embedded data files to a "_MEI" directory under the Temp folder upon execution. Files dropped under the "\nxc" sub-directory of that extraction path are unique to NetExec and serve as reliable on-disk indicators of execution. NetExec (formerly CrackMapExec) is a widely used post-exploitation and lateral movement tool used for Active Directory enumeration, credential harvesting, and remote code execution.

AppLocker Prevented Application or Script from Running

Dec 24, 2025 · attack.execution attack.t1204.002 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.006 attack.t1059.007 ·

Share on:

Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.

HackTool - Koadic Execution

Nov 24, 2025 · attack.execution attack.t1059.003 attack.t1059.005 attack.t1059.007 ·

Share on:

Detects command line parameters used by Koadic hack tool

Potential QBot Activity

Nov 24, 2025 · attack.execution attack.t1059.005 detection.emerging-threats ·

Share on:

Detects potential QBot activity by looking for process executions used previously by QBot

Suspicious Scripting in a WMI Consumer

Nov 24, 2025 · attack.execution attack.t1059.005 ·

Share on:

Detects suspicious commands that are related to scripting/powershell in WMI Event Consumers

Adwind RAT / JRAT

Aug 12, 2024 · attack.execution attack.t1059.005 attack.t1059.007 detection.emerging-threats ·

Share on:

Detects javaw.exe in AppData folder as used by Adwind / JRAT

Adwind RAT / JRAT File Artifact

Aug 12, 2024 · attack.execution attack.t1059.005 attack.t1059.007 ·

Share on:

Detects javaw.exe in AppData folder as used by Adwind / JRAT

Cscript/Wscript Uncommon Script Extension Execution

Aug 12, 2024 · attack.execution attack.t1059.005 attack.t1059.007 ·

Share on:

Detects Wscript/Cscript executing a file with an uncommon (i.e. non-script) extension

Potential APT10 Cloud Hopper Activity

Aug 12, 2024 · attack.execution attack.g0045 attack.t1059.005 detection.emerging-threats ·

Share on:

Detects potential process and execution activity related to APT10 Cloud Hopper operation

Potential Reconnaissance Activity Via GatherNetworkInfo.VBS

Aug 12, 2024 · attack.discovery attack.execution attack.t1615 attack.t1059.005 ·

Share on:

Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine

Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBS

Aug 12, 2024 · attack.discovery attack.execution attack.t1615 attack.t1059.005 ·

Share on:

Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine