Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Windows Script Execution from Archive

Identifies attempts to execute Jscript/Vbscript files from an archive file. The use of archives is a common delivery method of malicious scripts.

ATT&CK coverage

Execution

T1059Command and Scripting Interpreter488 detections cover this technique
- T1059.005Visual Basic 51 detections cover this technique
- T1059.007JavaScript 65 detections cover this technique
T1204User Execution138 detections cover this technique
- T1204.002Malicious File 117 detections cover this technique

Detection requirements

Log source category: event_index

What the source says

References

https://medium.com/walmartglobaltech/smartapesg-4605157a5b80

Tagged by the source as

Data Source: CrowdstrikeData Source: Elastic DefendData Source: Elastic EndgameData Source: Microsoft Defender XDRData Source: SentinelOneData Source: SysmonData Source: Windows Security Event LogsDomain: EndpointOS: WindowsResources: Investigation GuideTactic: ExecutionUse Case: Threat Detection

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.