Detect Visual Basic in Sumo Logic CSE
Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows technologies such as COM and the Native API. Derivative languages include Visual Basic for Applications (VBA) embedded in Microsoft Office documents and VBScript executed via Windows Script Host (wscript.exe/cscript.exe). VBA macros in Office documents remain one of the most prevalent initial access vectors, while VBScript is used in HTA files and standalone scripts for payload delivery and execution.
MITRE ATT&CK
- Tactic
- Execution
- Technique
- T1059 Command and Scripting Interpreter
- Sub-technique
- T1059.005 Visual Basic
- Canonical reference
- https://attack.mitre.org/techniques/T1059/005/
Sumo Detection Query
_sourceCategory=*windows*sysmon* OR _sourceCategory=*wineventlog*
| where EventID = "1" or EventCode = "1"
| parse field=Image "*\\*" as image_path, image_name nodrop
| parse field=CommandLine "*" as cmd nodrop
| where image_name in ("wscript.exe", "cscript.exe", "mshta.exe") or
Image matches "*\\wscript.exe" or Image matches "*\\cscript.exe" or Image matches "*\\mshta.exe"
| eval cmd_lower = toLowerCase(CommandLine)
| eval is_hta = if(image_name = "mshta.exe" or contains(cmd_lower, ".hta"), 1, 0)
| eval is_vbs = if(contains(cmd_lower, ".vbs") or contains(cmd_lower, ".vbe"), 1, 0)
| eval shell_exec = if(
contains(cmd_lower, "wscript.shell") or
contains(cmd_lower, "shell.application") or
contains(cmd_lower, "powershell") or
contains(cmd_lower, "cmd /c"), 2, 0)
| eval net_download = if(
contains(cmd_lower, "msxml2.xmlhttp") or
contains(cmd_lower, "winhttp") or
contains(cmd_lower, "adodb.stream"), 2, 0)
| eval wmi_exec = if(
contains(cmd_lower, "winmgmts") or
contains(cmd_lower, "win32_process"), 2, 0)
| eval encode_exec = if(
contains(cmd_lower, "-decode") or
contains(cmd_lower, "certutil") or
contains(cmd_lower, "bitsadmin"), 2, 0)
| eval suspicion_score = is_hta + is_vbs + shell_exec + net_download + wmi_exec + encode_exec
| where suspicion_score > 0
| fields _messagetime, Computer, User, image_name, CommandLine, ParentImage, ParentCommandLine, is_hta, is_vbs, shell_exec, net_download, wmi_exec, suspicion_score
| sort by _messagetime descSumo Logic CSE query detecting suspicious VBScript/HTA execution via wscript.exe, cscript.exe, and mshta.exe with multi-factor suspicion scoring. Identifies shell spawning, network download activity, WMI abuse, and encoded payload delivery consistent with T1059.005 initial access and execution patterns.
Data Sources
Required Tables
False Positives & Tuning
- IT automation frameworks (Ansible Windows WinRM, PowerShell DSC) that use cscript or wscript as part of configuration management tasks
- SAP GUI scripting or other enterprise ERP applications that embed VBScript macros executed via wscript.exe
- Security tools or EDR agents that use mshta.exe to render local HTML-based UI components or health dashboards
Other platforms for T1059.005
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1VBScript Execution via wscript.exe
Expected signal: Sysmon Event ID 1: Process Create for wscript.exe with the .vbs file path. Child process event for cmd.exe spawned by wscript.exe. Sysmon Event ID 11: File Create for the .vbs file.
- Test 2MSHTA Inline VBScript Execution
Expected signal: Sysmon Event ID 1: Process Create for mshta.exe with 'vbscript:Execute' in CommandLine. Child process creation for calc.exe spawned by mshta.exe.
- Test 3VBScript Network Download via XMLHTTP
Expected signal: Sysmon Event ID 1: Process Create for cscript.exe. Sysmon Event ID 3: Network Connection to 127.0.0.1:8080. AMSI Event: VBScript content inspection may trigger.
References (5)
- https://attack.mitre.org/techniques/T1059/005/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.005/T1059.005.md
- https://techcommunity.microsoft.com/t5/microsoft-365-blog/helping-users-stay-safe-blocking-internet-macros-by-default-in/ba-p/3071805
- https://lolbas-project.github.io/lolbas/Binaries/Mshta/
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation
Unlock Pro Content
Get the full detection package for T1059.005 including response playbook, investigation guide, and atomic red team tests.