WhatsApp VBScript Campaign → ManageEngine RMM Abuse

Looks for: wscript.exe/cscript.exe running a .vbs whose parent is a WhatsApp process (notably WhatsApp.Root.exe on Desktop). Accomplishes: catches the campaign at execution with the highest-fidelity lineage — WhatsApp has no business spawning a script host.

// HUNT: WhatsApp Desktop spawns wscript running a .vbs (flagship lineage)
// MITRE: T1566, T1059.005 | CONF: high  FP: low  COST: low
// FP NOTES: WhatsApp never legitimately launches a script host - near-zero benign baseline
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^WhatsApp(\.Root)?\.exe$/i
| FileName=/^(wscript|cscript)\.exe$/i
| CommandLine=/\.vbe?("|\s|$)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

Looks for: a script host running a .vbs from a user download/temp path, regardless of parent. Accomplishes: catches the WhatsApp Web path (manual execution, no WhatsApp.Root.exe parent) and any case where the parent is missing.

// HUNT: script host runs a .vbs from a user download/temp path (Web client / no parent)
// MITRE: T1059.005 | CONF: med-high  FP: low-med  COST: low
// TUNING: baseline legit admin .vbs in your estate; correlate to a WhatsApp file-write / Q1
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(wscript|cscript)\.exe$/i
| CommandLine=/\.vbe?("|\s|$)/i
| CommandLine=/\\(Downloads|Temp|AppData\\Local\\Temp)\\/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, CommandLine], limit=200)

Looks for: wscript/cscript making outbound connections to an external host shortly after running. Accomplishes: surfaces the secondary VBScript / ZIP fetch. FP: some logon/admin scripts reach internal hosts — exclude RFC1918 and correlate to a same-host Q1/Q2.

// HUNT: script host fetches secondary payload (outbound to external host)
// MITRE: T1105 | CONF: medium  FP: medium  COST: medium
// TUNING: exclude RFC1918 + sanctioned internal script destinations; correlate to Q1/Q2 on same aid
#event_simpleName=NetworkConnectIP4
| ContextBaseFileName=/^(wscript|cscript)\.exe$/i
| RemoteAddressIP4!=/^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|169\.254\.|127\.)/
| table([@timestamp, ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort], limit=200)

Looks for: msiexec installing a ManageEngine package, or a ManageEngine / RMM Central / UEMS agent binary executing. Accomplishes: catches the abused legitimate RMM. Dual-use: ManageEngine is legitimate — exclude IT-sanctioned RMM management subnets / installer hashes and correlate to the .vbs lineage.

// HUNT: ManageEngine RMM Central install/exec where no RMM is IT-sanctioned
// MITRE: T1219 | CONF: medium  FP: medium  COST: low
// TUNING: allow-list sanctioned RMM mgmt subnets + known installer SHA256; correlate to Q1/Q2
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| (CommandLine=/manageengine|rmm.?central|uems[_-]?agent|dcregister|dcconfig/i or FileName=/^(UEMS_Agent|dcagentservice|dcagenttrayicon)\.exe$/i)
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

Looks for: any process connecting to the published C2 IP 202.61.160.201 (overlaps prior Gh0st RAT / ValleyRAT infra). Accomplishes: a high-confidence atomic catch. Note: single sourced IOC — infra rotates, so keep the behavioral queries as primary coverage.

// HUNT: connection to known campaign C2 (Gh0st/ValleyRAT infra overlap)
// MITRE: T1071 | CONF: high  FP: low  COST: low
// FP NOTES: atomic IOC from source; rotates - pair with behavioral Q1/Q4 for durable coverage
#event_simpleName=NetworkConnectIP4
| RemoteAddressIP4="202.61.160.201"
| table([@timestamp, ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort], limit=200)

Looks for: service-control / scheduled-task creation parented by a script host (or its descendants) — the ZIP-to-persistence step. Accomplishes: catches the RMM agent or backdoor being made persistent. FP: legit software installs create services — correlate strictly to a same-host Q1/Q2.

// HUNT: script host establishes persistence (new service / scheduled task)
// MITRE: T1543.003, T1053.005 | CONF: medium  FP: medium  COST: low
// TUNING: scope to hosts with a recent Q1/Q2 hit; allow-list sanctioned software-install service creates
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^(wscript|cscript)\.exe$/i
| (FileName=/^(sc|schtasks)\.exe$/i or CommandLine=/sc(\.exe)?\s+create|schtasks(\.exe)?\s+\/create|New-Service|Register-ScheduledTask/i)
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)