You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml
+44-18Lines changed: 44 additions & 18 deletions
Original file line number
Diff line number
Diff line change
@@ -1,33 +1,57 @@
1
1
name: Detect Use of cmd exe to Launch Script Interpreters
2
2
id: b89919ed-fe5f-492c-b139-95dbb162039e
3
-
version: 13
4
-
date: '2026-03-10'
3
+
version: 14
4
+
date: '2026-03-24'
5
5
author: Bhavin Patel, Mauricio Velazco, Splunk
6
6
status: production
7
-
type: TTP
8
-
description: The following analytic detects the execution of cscript.exe or wscript.exe processes initiated by cmd.exe. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and parent processes within the Endpoint data model. This activity is significant as it may indicate script-based attacks or administrative actions that could be leveraged for malicious purposes. If confirmed malicious, this behavior could allow attackers to execute scripts, potentially leading to code execution, privilege escalation, or persistence within the environment.
7
+
type: Anomaly
8
+
description: |
9
+
The following detects the execution of cscript.exe or wscript.exe processes spawned by cmd.exe, leveraging Endpoint Detection and Response (EDR) telemetry mapped to the Endpoint data model, with additional contextual filtering to improve fidelity and reduce false positives.
10
+
It focuses on executions originating from user-writable directories such as Users, AppData, Temp, and Downloads, which are commonly abused by attackers to stage and execute malicious scripts, while excluding trusted system paths like C:\Windows\System32\ and C:\Program Files\ that are typically associated with legitimate activity.
11
+
The detection also filters out service accounts (e.g., accounts ending with $ or known naming conventions) to minimize noise from automated processes and incorporates command-line context to better assess script execution patterns and identify potentially suspicious behavior.
9
12
data_source:
10
13
- Sysmon EventID 1
11
14
- Windows Event Log Security 4688
12
15
- CrowdStrike ProcessRollup2
13
16
search: |-
14
-
| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
15
-
WHERE Processes.parent_process_name="cmd.exe" (Processes.process_name=cscript.exe
17
+
| tstats `security_content_summariesonly`
18
+
count min(_time) as firstTime
19
+
max(_time) as lastTime
20
+
21
+
FROM datamodel=Endpoint.Processes WHERE
22
+
23
+
Processes.parent_process_name="cmd.exe"
24
+
(
25
+
Processes.process_name IN ("cscript.exe", "wscript.exe")
16
26
OR
17
-
Processes.process_name =wscript.exe)
18
-
BY Processes.action Processes.dest Processes.original_file_name
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
30
-
known_false_positives: This detection may also be triggered by legitimate applications and numerous service accounts, which often end with a $ sign. To manage this, it's advised to check the service account's activities and, if they are valid, modify the filter macro to exclude them.
53
+
known_false_positives: |-
54
+
This detection may still generate alerts from legitimate administrative or enterprise activity, particularly in environments that rely on logon scripts, software deployment tools (e.g., SCCM, Intune), legacy applications, or IT automation frameworks that execute scripts via cmd.exe. Some organizations may also have internally developed scripts that run from user-writable directories, which can appear suspicious but are benign. Additionally, environments with non-standard application installations or portable tools may trigger this detection.
Copy file name to clipboardExpand all lines: detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml
+57-10Lines changed: 57 additions & 10 deletions
Original file line number
Diff line number
Diff line change
@@ -1,21 +1,64 @@
1
1
name: Scheduled Task Deleted Or Created via CMD
2
2
id: d5af132c-7c17-439c-9d31-13d55340f36c
3
-
version: 25
4
-
date: '2026-03-10'
3
+
version: 26
4
+
date: '2026-03-26'
5
5
author: Bhavin Patel, Splunk
6
6
status: production
7
-
type: TTP
8
-
description: The following analytic identifies the creation or deletion of scheduled tasks using the schtasks.exe utility with the -create or -delete flags. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it can indicate unauthorized system manipulation or malicious intent, often associated with threat actors like Dragonfly and incidents such as the SUNBURST attack. If confirmed malicious, this activity could allow attackers to execute code, escalate privileges, or persist within the environment, posing a significant security risk.
7
+
type: Anomaly
8
+
description: The following analytic detects the creation or deletion of scheduled tasks via schtasks.exe when invoked with create or delete flags, specifically focusing on those executions where the process includes additional parameters such as /tr, /sc, or /ru. The detection uses Endpoint Detection and Response (EDR) telemetry mapped to the Endpoint data model, and filters out events originating from trusted system paths like C:\Windows\System32 or C:\Program Files. It further narrows results to cases where schtasks.exe is launched by potentially suspicious parent processes such as cmd.exe, wscript.exe, or cscript.exe, and excludes service accounts. This behavior may indicate adversary efforts to gain persistence or evade detection by manipulating scheduled tasks using scripts or command shells. If confirmed malicious, such activity could lead to unauthorized code execution or the removal of monitoring mechanisms on endpoints.
9
9
data_source:
10
10
- Sysmon EventID 1
11
11
- Windows Event Log Security 4688
12
12
- CrowdStrike ProcessRollup2
13
-
search: '| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe (Processes.process=*delete* OR Processes.process=*create*) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `scheduled_task_deleted_or_created_via_cmd_filter`'
13
+
search: |
14
+
| tstats `security_content_summariesonly`
15
+
count
16
+
min(_time) as firstTime
17
+
max(_time) as lastTime
18
+
FROM datamodel=Endpoint.Processes WHERE
19
+
20
+
Processes.parent_process_name="cmd.exe"
21
+
Processes.process_name="schtasks.exe"
22
+
Processes.process IN (
23
+
"*/create*",
24
+
"*-create*",
25
+
"*/delete*",
26
+
"*-delete*"
27
+
)
28
+
NOT Processes.process IN (
29
+
"* \"C:\\Program Files (x86)\\*",
30
+
"* \"C:\\Program Files\\*",
31
+
"* \"C:\\Windows\\System32\\*",
32
+
"* \"C:\\Windows\\SysWOW64\\*",
33
+
"* C:\\Program Files (x86)\\*",
34
+
"* C:\\Program Files\\*",
35
+
"* C:\\Windows\\System32\\*",
36
+
"* C:\\Windows\\SysWOW64\\*"
37
+
)
38
+
NOT Processes.user="*$"
39
+
40
+
BY Processes.action Processes.dest Processes.original_file_name
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
15
-
known_false_positives: While it is possible for legitimate scripts or administrators to trigger this behavior, filtering can be applied based on the parent process and application to reduce false positives. Analysts should reference the provided references to understand the context and threat landscape associated with this activity.
54
+
known_false_positives: |-
55
+
While it is possible for legitimate scripts or administrators to trigger this behavior, filtering can be applied based on the parent process and application to reduce false positives.
56
+
Analysts should reference the provided references to understand the context and threat landscape associated with this activity.
- name: View the detection results for - "$dest$" and "$user$"
21
64
search: '%original_detection_search% | search dest = "$dest$" user = "$user$"'
@@ -26,15 +69,19 @@ drilldown_searches:
26
69
earliest_offset: $info_min_time$
27
70
latest_offset: $info_max_time$
28
71
rba:
29
-
message: A schedule task process $process_name$ with create or delete commandline $process$ in host $dest$
72
+
message: A parent process [parent_process_name$] with commandline [$parent_process$] spawned a schedule task process [$process_name$] with create or delete commandline [$process$] on host [$dest$]
0 commit comments