Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
Identifies VBScript proxy execution through a registry key in \Microsoft\Windows\CurrentVersion.
| Attribute | Value |
|---|---|
| Type | Hunting Query |
| Solution | Cyborg Security HUNTER |
| ID | 3ac1e703-3ed0-45e1-ae1d-0fa60baf99fb |
| Tactics | DefenseEvasion, Execution |
| Techniques | T1059.005, T1218.005 |
| Required Connectors | SecurityEvent |
| Source | View on GitHub |
This content item queries data from the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
SecurityEvent |
CommandLine contains "\\Microsoft\\Windows\\CurrentVersion"CommandLine has_all "Execute"CommandLine has_all "vbscript"Process has_any "cmd.exe" |
✓ | ✓ | ✓ |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊