Cscript/Wscript Potentially Suspicious Child Process
Detects potentially suspicious child processes spawned by Wscript.exe or Cscript.exe. This includes scenarios where these script hosts launch command-line interpreters (cmd.exe, powershell.exe) that then execute tools like rundll32, regsvr32, msiexec, or mshta with network-related arguments. It also covers direct spawning of rundll32.exe by Wscript/Cscript, while filtering out common legitimate uses of rundll32. This behavior is often observed in malware such as Pikabot and Qakbot for execution and defense evasion.
Sigma
