Reproduce rule "Executing scripts by Windows script host (CScript.exe or Wscript.exe) ..."

[PawelEm]

I want to make a custom version of mcafee defined rule "Executing scripts by Windows script host (CScript.exe or Wscript.exe) from common user folders" I have plenty of false positives coused by this rule and want to make some exclusions. Tired to sort this out on community but it didn't work for me (link below) Can i ask for some help in this case? https://community.mcafee.com/t5/Endpoint-Security-ENS/Exclusions-for-Access-protection-s-quot-Block-...

[Daveb3d]

I think this should do it.

Rule {
Process {
Include AggregateMatch {
Include OBJECT_NAME { -v "wscript.exe" }
Include PROCESS_CMD_LINE {
-v "*c:\\users*"
-v "*c:\\programdata*"
-v "c:\\windows\\temp*"
}
Exclude PROCESS_CMD_LINE {
-v "*FalsePositivesHere*"
}
}
Include AggregateMatch {
Include OBJECT_NAME { -v "cscript.exe" }
Include PROCESS_CMD_LINE {
-v "*c:\\users*"
-v "*c:\\programdata*"
-v "c:\\windows\\temp*"
}
Exclude PROCESS_CMD_LINE {
-v "*FalsePositivesHere*"
}
}
}
Target {
Match SECTION {
Include OBJECT_NAME { -v "version.dll" }
Include -access "CREATE"
}
}
}

When you want to block, change "version.dll" to just "**" 

From an attack perspective, a bit cleaner and to minimize risk, you might consider the following:

Block Office from Executing these two processes.
Change the default file association of various scripts from c/wscript to notepad.  So a user can't just double click them.  Instead, they have to define the execution in a command line.

Dave

[Buijspa]

Hi,

This ER is working as expected.

Where can I find the command line launched by cscript.exe/wscript.exe ?

For the moment, this information is not present in the logs, only "C:\Windows\SysWOW64\cscript.exe, which accessed the process version.dll".

Thanks for your help!

Kr,

buijspa

[Buijspa]

For some alerts I received this :

Source Description:

cscript \windows\system32\slmgr.vbs -ato

But for the majority only this :

Source Description:

cscript.exe

[Daveb3d]

Hard to say without 1) knowing your rule logic and 2) knowing the actual command line (is there really one?).  

If you are using 10.7 you might consider going this route on the rule, which should give you even more visibility:

Rule {
	Process {
		Include OBJECT_NAME { -v "**" }
	}
	Target {
		Match PROCESS {
			Include AggregateMatch {
				Include OBJECT_NAME { -v "wscript.exe" }
				Include PROCESS_CMD_LINE {
					-v "*c:\\users*"
					-v "*c:\\programdata*"
					-v "c:\\windows\\temp*"
				}
				Exclude PROCESS_CMD_LINE {
					-v "*FalsePositivesHere*"
				}
			}
			Include AggregateMatch {
				Include OBJECT_NAME { -v "cscript.exe" }
				Include PROCESS_CMD_LINE {
					-v "*c:\\users*"
					-v "*c:\\programdata*"
					-v "c:\\windows\\temp*"
				}
				Exclude PROCESS_CMD_LINE {
					-v "*FalsePositivesHere*"
				}
			}
			Include -access "CREATE"
		}
	}
}

[Buijspa]

Hi Dave,

Thanks for your swift reply.

Indeed, it works better with this ER : now I see that the cscript process is launched from 

"C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\libs\node.exe" "C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\js\main.js"

Thanks for your help!

Kind regards,

buijspa