LOLBAS01 / TRADECRAFT
1 examplesCommand reference
ADS1
EXAMPLE 01T1564.004
Use cscript.exe to exectute a Visual Basic script stored in an Alternate Data Stream (ADS).
COMMAND
cscript //e:vbscript {PATH_ABSOLUTE}:script.vbs02 / ON DISK
Known paths
C:\Windows\System32\cscript.exeC:\Windows\SysWOW64\cscript.exe03 / DEFENSIVE INTELLIGENCE
7 resourcesDetection & indicators
- Sigmaproc_creation_win_wscript_cscript_script_exec.ymlgithub.com
- Sigmafile_event_win_net_cli_artefact.ymlgithub.com
- Elasticdefense_evasion_unusual_dir_ads.tomlgithub.com
- Elasticcommand_and_control_remote_file_copy_scripts.tomlgithub.com
- Elasticdefense_evasion_suspicious_managedcode_host_process.tomlgithub.com
- Splunkwscript_or_cscript_suspicious_child_process.ymlgithub.com
- BlockRulemicrosoft recommended block rulesdocs.microsoft.com
Indicators & detection notes
- IOC
Cscript.exe executing files from alternate data streams
- IOC
DotNet CLR libraries loaded into cscript.exe
- IOC
DotNet CLR Usage Log - cscript.exe.log
FURTHER READING
Research & resources
COMMUNITY RESEARCH
Acknowledgements
Oddvar Moe@oddvarmoe