liveBook · Manning

Cscript.exe

As explained in Cyber Threat Hunting

cscript.exe is the Windows command-line script host that executes scripts through a selected scripting engine.

cscript.exe is a Windows command-line script host. In process telemetry, its command line can reveal a script’s engine, source file, and argument handling—useful clues when reconstructing a suspicious execution chain. section 3.1.4

Read the observed invocation in order:

  • Identify the script host and the referenced file. Here, cscript.exe runs www.txt from AppData\Roaming. section 3.1.4
  • Interpret //E:VBScript as selection of the VBScript engine and //NoLogo as banner suppression. section 3.1.4
  • Treat %~f0 and %* as batch-file argument expansions; together, the command line indicates VBScript execution within a batch file. section 3.1.4
  • Pivot on the parent and child process fields to connect the host to later PowerShell, cmd.exe, and rundll32 activity. section 3.1.4

Tracing a script-host pivot

A Word-launched cscript.exe process runs www.txt with the VBScript engine. Seconds later, telemetry records PowerShell launching www.ps1 with ExecutionPolicy Bypass and cmd.exe launching rundll32 against several DLLs. The shared parent command line ties these events to one execution path. section 3.1.4

Listing 3.13 Free text search for www.txt in Sysmon events
DESKTOP-PC01 AND
source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" AND
/www.txt/i
| table([_raw.UtcTime, host.name, _raw.EventID, _raw.CommandLine, 
         _raw.ParentCommandLine], order=asc)

Search for the referenced script filename, then table timestamps, event IDs, command lines, and parent command lines to reconstruct cscript.exe activity. section 3.1.4

How Cyber Threat Hunting covers it

How deep it goes
Explains observed switches and batch argument expansions, but does not inspect the VBScript file’s contents.
Examples
Traces www.txt launching PowerShell and multiple rundll32 commands after a Word process.
What you can do after
Evaluate/understand a cscript.exe command line and pivot through related process events.
How it connects
Connects cscript.exe to VBScript, PowerShell, cmd.exe, rundll32, Sysmon, and process creation.
Cover of Cyber Threat Hunting
liveBookmanning.com
Read Cyber Threat Hunting on liveBook Get the book at manning.com

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.