BIOC
Informational
✕
Wscript / Cscript executed from a temporary directory
An attacker may try to avoid detection by executing wscript/cscript scripts from a temporary directory.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Collection
- Status:
- Enabled
ATT&CK tactics: Collection (TA0009)
ATT&CK techniques: Data Staged: Local Data Staging (T1074.001)
Indicator:
Process action type = execution AND target process path = *tmp* , *temp* AND target process cmd =~ (?i)(.* [\/]{1,2}([bisx] |[eh]:(.script|.*script)?|job:|t:\d{1,5})).* Host host os = windows
Preventable: yes