AN1288
Analytic 1288
Windows
Execution of Microsoft-signed scripts (e.g., pubprn.vbs, installutil.exe, wscript.exe, cscript.exe) used to proxy execution of untrusted or external binaries. Behavior is detected through command-line process lineage, child process spawning, and unsigned payload execution from signed parent.
WinEventLog:Sysmon
EventCode=1
WinEventLog:PowerShell
EventCode=4103, 4104, 4105, 4106
WinEventLog:Sysmon
EventCode=7
WinEventLog:Sysmon
EventCode=10
WinEventLog:Sysmon
EventCode=11
[ParentProcessName]
Environment-specific paths to script interpreters like wscript.exe, cscript.exe, pubprn.vbs, or installutil.exe.
[TimeWindow]
Time delta between signed script execution and suspicious child process creation.
[ChildCommandLineRegex]
Regex pattern used to detect malicious payload execution (e.g., download cradle, PowerShell decode).
[SignedToUnsignedTransition]
Indicates whether the parent is signed by Microsoft but child is unsigned or unknown.