wscript_execution_in_appdata_gootloader.yml

title: Wscript.exe Executing Agreement Javascript in AppData Folder
id: c9677b37-50f0-44d3-b8f8-24b5b5eed570
status: experimental
description: Detects potential stage 1 Gootloader javascript execution.
references:
    - https://redcanary.com/blog/gootloader/
    - https://blogs.blackberry.com/en/2022/07/gootloader-from-seo-poisoning-to-multi-stage-downloader
author: Micah Babinski
date: 2022/11/07
tags:
    - attack.execution
    - attack.t1059
    - attack.t1059.005
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\wscript.exe'
        CommandLine|contains|all:
            - '\appdata\'
            - 'agreement'
        CommandLine|endswith: '.js'
    condition: selection
falsepositives:
    - Unknown
level: high