AN0209
Analytic 0209
Windows
Detects execution of VB-based scripts or macros (VBS/VBA/VBScript) through cscript.exe/wscript.exe, Office-based process chains, or HTA usage. Focuses on chained behavior: Office or HTML container spawns script host > script host spawns PowerShell, network connections, or process injection.
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=7
[ParentProcess]
Microsoft Word/Excel or mshta.exe spawning wscript.exe/cscript.exe.
[UserContext]
Script execution by non-admin users or service accounts.
[TimeWindow]
Script execution outside normal business hours or patching cycle.
[PayloadEntropyThreshold]
High entropy indicative of obfuscation or encoding in the script.
[ModuleName]
Loading of vbscript.dll, scrrun.dll, or other scripting engine modules.
AN0210
Analytic 0210
macOS
Detects embedded or emulated VBScript/VBA execution via Wine-based apps, Office for Mac abusing cross-platform .NET features, or macros dropped and invoked via AppleScript or third-party automation tools.
macos:unifiedlog
log stream --predicate 'eventMessage contains "wscript" OR "vbs"'
macos:osquery
process_events
macos:syslog
system.log
[ScriptLocation]
Script run from ~/Downloads, ~/Library, or /tmp/
[EmulationContext]
Wine or CrossOver launching legacy Windows scripting engines.
[UserContext]
VB execution from non-standard or shared users on endpoint.
AN0211
Analytic 0211
Linux
Detects abuse of Mono/.NET Core environments to execute VB-like scripts, often in environments with Office emulation or WINE. Focus is on rare invocations of scripting hosts like mono.exe or .NET shells, often seen in spam filtering or forensic labs with Office support.
auditd:SYSCALL
execve
linux:syslog
/var/log/syslog
[InterpreterPath]
Mono/.NET Core binary location may differ per distro or Docker container.
[FileExtension]
.vbs, .vb, or .vba run under non-standard interpreters.
[ExecContext]
Execution by low-privilege users or from /tmp/.