Real-time monitoring identifies wscript.exe/cscript.exe, Office macro, or HTA-driven Visual Basic execution from unexpected parents/paths or followed by PowerShell, command shell, network activity, or system modification. Alert only when the interpreter is not part of the asset's approved software/automation baseline or its execution context violates an approved signer/hash/path/parent/user rule, and require OT-relevant corroboration such as access to engineering files, ICS software/API use, communications with protected OT assets, configuration change, or another suspicious follow-on behavior. Suppress documented vendor software, engineering workflows, diagnostics, backup, patching, and approved maintenance.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | WinEventLog:Sysmon | EventCode=1; wscript.exe/cscript.exe/mshta.exe and child-process lineage |
| Module Load (DC0016) | WinEventLog | EventCode=7; vbscript.dll/scrrun.dll or unusual scripting-engine modules |
| Field | Description |
|---|---|
| ParentProcess | Approved Office/vendor application relationships |
| ScriptLocation | Approved script/macro paths versus temp/download/user-writable paths |
| UserContext | Authorized users/service accounts |
| ModuleName | VB scripting engine modules expected on the asset |
| MaintenanceWindow | Approved business/engineering automation periods |