CVE-2021-34448

Sentinel/Defender KQL

DeviceProcessEvents
| where FileName in~ ("wscript.exe", "cscript.exe")
| where ProcessCommandLine has_any ("-e", "-f", "-h") or ProcessCommandLine contains ".js" or ProcessCommandLine contains ".vbs"
| where InitiatingProcessFileName != "explorer.exe" // Filter out common user interaction
| summarize count() by DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine
| where count_ > 5 // Adjust threshold as needed for your environment
| project DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, count_

Splunk SPL

index=windows_events (sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1) (Image="*\\wscript.exe" OR Image="*\\cscript.exe")
| where not (ParentImage="*\\explorer.exe")
| stats count by Host, ParentImage, Image, CommandLine
| where count > 5

Sigma

title: Windows Scripting Engine Memory Corruption Behavioral Detection
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects suspicious activity related to the Windows Scripting Engine that might indicate exploitation of memory corruption vulnerabilities.
author: SecBoard
date: 2024/07/30
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
  filter_legitimate:
    ParentImage|endswith: '\explorer.exe'
  condition: selection and not filter_legitimate
fields:
  - CommandLine
  - ParentImage
  - Image
level: medium

Elastic ES|QL

from process where event.type == "start" and (process.executable : "*\\wscript.exe" or process.executable : "*\\cscript.exe") and not process.parent.executable : "*\\explorer.exe"
| stats count() by host.name, process.parent.executable, process.executable, process.command_line
| where count > 5