Real-time monitoring identifies wscript.exe/cscript.exe/mshta.exe or other JScript execution from unexpected parents/paths, especially when followed by child interpreters, network connections, or system modification. Alert only when the interpreter is not part of the asset's approved software/automation baseline or its execution context violates an approved signer/hash/path/parent/user rule, and require OT-relevant corroboration such as access to engineering files, ICS software/API use, communications with protected OT assets, configuration change, or another suspicious follow-on behavior. Suppress documented vendor software, engineering workflows, diagnostics, backup, patching, and approved maintenance.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | WinEventLog:Sysmon | EventCode=1; wscript.exe/cscript.exe/mshta.exe and child-process lineage |
| Module Load (DC0016) | WinEventLog:Sysmon | EventCode=7; scripting-engine module loads when useful |
| Field | Description |
|---|---|
| ApprovedScriptHosts | Allowed script hosts and vendor applications |
| ParentProcess | Expected parent-child relationships |
| ScriptPath | Approved script locations |
| UserContext | Authorized users/services |
| MaintenanceWindow | Approved automation/support windows |
Real-time monitoring identifies node/nodejs or another JavaScript runtime launched from an unexpected service, web process, scheduled task, user, or path, followed by outbound connections, shell execution, persistence, or OT-relevant access. Alert only when the interpreter/shell is not expected for the asset role or user/service context, or when its parent, path, arguments, remote-session source, or follow-on behavior violates the approved OT baseline. Suppress approved engineering scripts, vendor support, diagnostics, backup, patching, and maintenance windows.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | auditd:SYSCALL | execve for node/nodejs or JavaScript runtime and child processes |
| Network Connection Creation (DC0082) | linux:osquery | socket_events for runtime-originated connections, where deployed |
| Field | Description |
|---|---|
| ApprovedRuntime | Approved Node.js/runtime paths and versions |
| ParentProcess | Expected service/application parents |
| ScriptPath | Approved application/script locations |
| UserContext | Expected service users |
| ApprovedDestinations | Expected OT/external communications |