Windows Script Host launching a JScript or JSE file

Siemphony@siemphonylowT1059.007unverifiedPlaybook · Unexpected execution

AN0733's Windows leg, narrowed to what actually separates this technique from its command-interpreter siblings elsewhere in this corpus: not that wscript.exe or cscript.exe ran, but that the file handed to it is a JScript source (.js) or encoded JScript (.jse). Sibling rules already in this corpus key on wscript.exe/cscript.exe/mshta.exe as children of an Office application or explorer.exe without checking which scripting language was invoked, since Windows Script Host runs VBScript and JScript through the same two binaries; this rule is deliberately host-plus-extension only, with no ParentImage gate, so it also catches JScript launched directly (a scheduled task, a shortcut, a double-click) rather than only the Office/browser-spawned case AN0733 highlights. mshta.exe is excluded: an HTA file gives no signal on this command line for which script language it embeds, so including it here would be a claim this logic cannot support. The analytic's correlated network and system-modification legs are separate events with no join Sigma can express, so this rule matches on launch alone. The command-line substring match on `.js` is a known limitation: it would also match a `.json` argument passed alongside the script path, though wscript/cscript invocations are typically single-file and this is not expected to be a meaningful source of noise. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0264, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Windows Script Host launching a JScript or JSE file2id: b03b00a3-890e-45d2-8f53-abc359978cda3status: experimental4description: |5  AN0733's Windows leg, narrowed to what actually separates this technique6  from its command-interpreter siblings elsewhere in this corpus: not that7  wscript.exe or cscript.exe ran, but that the file handed to it is a JScript8  source (.js) or encoded JScript (.jse). Sibling rules already in this9  corpus key on wscript.exe/cscript.exe/mshta.exe as children of an Office10  application or explorer.exe without checking which scripting language was11  invoked, since Windows Script Host runs VBScript and JScript through the12  same two binaries; this rule is deliberately host-plus-extension only, with13  no ParentImage gate, so it also catches JScript launched directly (a14  scheduled task, a shortcut, a double-click) rather than only the15  Office/browser-spawned case AN0733 highlights. mshta.exe is excluded: an16  HTA file gives no signal on this command line for which script language it17  embeds, so including it here would be a claim this logic cannot support.18  The analytic's correlated network and system-modification legs are19  separate events with no join Sigma can express, so this rule matches on20  launch alone. The command-line substring match on `.js` is a known21  limitation: it would also match a `.json` argument passed alongside the22  script path, though wscript/cscript invocations are typically single-file23  and this is not expected to be a meaningful source of noise.24  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0264, not hand-written and not tested by its author. Any lab result is on this rule's own page.25references:26  - https://attack.mitre.org/techniques/T1059/00727  - https://attack.mitre.org/detectionstrategies/DET026428author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)29date: 2026-08-1630tags:31  - attack.execution32  - attack.t1059.00733logsource:34  category: process_creation35  product: windows36detection:37  selection_host:38    Image|endswith:39      - '\wscript.exe'40      - '\cscript.exe'41  selection_js_file:42    CommandLine|contains:43      - '.js'44      - '.jse'45  condition: selection_host and selection_js_file46falsepositives:47  - "Legacy logon and drive-mapping scripts. Some enterprises still deploy JScript logon scripts through Group Policy (cscript.exe against a script on the NETLOGON share), which fires at every interactive logon fleet-wide — check for this before enabling the rule anywhere near production."48  - "Software packaging and deployment tooling (SCCM, Ivanti, PDQ Deploy and similar) that ships silent-install or configuration wrapper scripts written in JScript and invokes them through wscript.exe or cscript.exe as a routine step of application deployment."49level: low

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "\\wscript.exe" or FolderPath endswith "\\cscript.exe") and (ProcessCommandLine contains ".js" or ProcessCommandLine contains ".jse"))

Splunk · SPL

Run this as a search.

index=* ((Image="*\\wscript.exe" OR Image="*\\cscript.exe") AND (CommandLine="*.js*" OR CommandLine="*.jse*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\wscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cscript.exe") AND (TO_LOWER(process.command_line) LIKE "*.js*" OR TO_LOWER(process.command_line) LIKE "*.jse*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\wscript\.exe$|\\cscript\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)(\.js|\.jse)</field>    <description>Windows Script Host launching a JScript or JSE file</description>    <mitre>      <id>T1059.007</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: low
Category: script_interpreter_execution
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: b03b00a3-890e-45d2-8f53-abc359978cda

ATT&CKT1059.007

T1059.007JavaScript

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1059.007, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 2 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Add the .json collision as an explicit falsepositives entry, as the
MITRE's ParentProcess knob is unimplemented here by design; pairing this
MITRE's EntropyScore (AMSI/ScriptBlock-detected obfuscation) and
Close the evasion the reviewer found: cscript.exe //E:jscript payload.txt

Declared by the author

Legacy logon and drive-mapping scripts. Some enterprises still deploy JScript logon scripts through Group Policy (cscript.exe against a script on the NETLOGON share), which fires at every interactive logon fleet-wide — check for this before enabling the rule anywhere near production.
Software packaging and deployment tooling (SCCM, Ivanti, PDQ Deploy and similar) that ships silent-install or configuration wrapper scripts written in JScript and invokes them through wscript.exe or cscript.exe as a routine step of application deployment.

Lessonscript interpreter execution

script interpreter executionAI draft — unreviewed

01 · What this rule detects

Windows Script Host (wscript.exe or cscript.exe) launching a file whose command line carries a .js or .jse extension. That is narrower than AN0733's own description, which centers on WSH/HTA execution "particularly when spawned from Office macros, web browsers, or abnormal user paths." wscript.exe and cscript.exe run VBScript and JScript through the same two binaries, so a rule that only checks the host process can't separate this technique from its VBScript sibling elsewhere in the corpus — the extension check exists specifically to make that distinction. The cost is that AN0733's parent-process gate is dropped entirely, so this rule also fires on JScript launched by a scheduled task or a double-click, not only the Office/browser case MITRE calls out. mshta.exe, which AN0733 also names, is deliberately excluded: an HTA's command line gives no signal about which scripting language it embeds, so including it would assert a distinction this logic can't support.

02 · Telemetry you need

Sysmon EventID 1 (process_creation), for Image and CommandLine. This
AN0733 also lists Sysmon EventID 7 (image_load) as a data component for

03 · How the logic works

Two unanchored substring tests, ANDed. The rendered Splunk shows it plainly: (Image="*\wscript.exe" or Image="*\cscript.exe") AND (CommandLine="*.js*" or CommandLine="*.jse*"). Neither half checks position, so .js matches anywhere in the command line, not only as a trailing file extension. That looseness is also the rule's known hole: the review flags that CommandLine|contains: '.js' matches inside .json too. cscript.exe deploy.vbs config.json — a VBScript deploy script taking a JSON argument, no JScript file anywhere — satisfies selection_js_file and fires. The rule's description calls this a "known limitation," but per this corpus's own contract a benign string that actually matches belongs in falsepositives, not prose; the reviewer flagged that gap and it is still unresolved in the current rule.

04 · Common false positives

GPO logon scripts. Some enterprises still push JScript logon or
Deployment tooling. SCCM, Ivanti, PDQ Deploy and similar routinely wrap
The unlisted one: any command line carrying a .json argument, per the

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0264 and never executed against logs. level: low is the author's judgement, plausible against the GPO logon-script false positive, but nothing here has been checked against a real fleet.
tier_2: means running it over history, confirming which false positive actually dominates, and closing the .json gap.
tier_3: means adding a ParentProcess variant, the //E:jscript catch, and picking up AN0734 and AN0735 — the macOS JXA and Linux Node.js legs of this same detection strategy have no authored rule anywhere in this corpus yet.

Related detections6 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/b03b00a3-890e-45d2-8f53-abc359978cda

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Windows Script Host launching a JScript or JSE file

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it