VB Script Usage Detection
Query
//KQL Query to identify usage of VBScript engine and artefacts in your environment
//Helps prepare for upcoming VBScript deprecation
// Sentinel
union DeviceProcessEvents, DeviceNetworkEvents, DeviceEvents
| where TimeGenerated > ago(30d)
| where ProcessCommandLine has_any ("wscript", "Wscript.Shell", "WScript.CreateObject", "cscript", "vbscript")
| extend CommandLine = parse_command_line(ProcessCommandLine, "windows")
| mv-expand CommandLine
| where CommandLine has ".vbs"
| summarize Count = count() by VBScript = tostring(CommandLine)
// Defender XDR
union DeviceProcessEvents, DeviceNetworkEvents, DeviceEvents
| where Timestamp > ago(30d)
| where ProcessCommandLine has_any ("wscript", "Wscript.Shell", "WScript.CreateObject", "cscript", "vbscript")
| extend CommandLine = parse_command_line(ProcessCommandLine, "windows")
| mv-expand CommandLine
| where CommandLine has ".vbs"
| summarize Count = count() by VBScript = tostring(CommandLine)Explanation
This KQL (Kusto Query Language) query is designed to help identify the usage of the VBScript engine and related artifacts within your environment, which is important for preparing for the upcoming deprecation of VBScript. Here's a simplified breakdown of what the query does:
-
Data Sources: It pulls data from three sources:
DeviceProcessEvents,DeviceNetworkEvents, andDeviceEvents. -
Time Frame: It filters the data to include only events from the last 30 days.
-
VBScript Indicators: It looks for specific keywords in the command line of processes that indicate the use of VBScript or related components. These keywords include "wscript", "Wscript.Shell", "WScript.CreateObject", "cscript", and "vbscript".
-
Command Line Parsing: The query parses the command line strings to extract individual components.
-
VBScript Files: It further filters the results to include only those command lines that reference files with a ".vbs" extension, which are VBScript files.
-
Summarization: Finally, it counts the occurrences of each unique VBScript command line and presents them in a summarized format, showing how often each VBScript-related command line was used.
This query is run twice, once for Sentinel and once for Defender XDR, to ensure comprehensive coverage across different security platforms.
Details
Nicola Suter
Released: November 10, 2024
Tables
Keywords
Operators