Merge pull request #189 from redcanaryco/Update--scripting-definition…

…-file Update scripting definition file
redcanaryco · Nov 6, 2024 · 14cb66e · 14cb66e
2 parents 3dea5f5 + 0b5181e
commit 14cb66e
Showing 1 changed file with 24 additions and 2 deletions.
diff --git a/definitions/scripting.json b/definitions/scripting.json
@@ -3,7 +3,7 @@
         "process_name": ["autoit.exe"]
     },
     "Powershell": { 
-        "process_name": ["powershell.exe"]
+        "process_name": ["powershell*.exe", "pwsh.exe", "posh.exe", "runscripthelper.exe"]
     },
     "PSExec": { 
         "process_name": ["psexec*.exe",
@@ -15,9 +15,24 @@
     "WScript": { 
         "process_name": ["wscript.exe"]
     },
+    "Jscript":{
+        "process_name": ["jscript.exe"]
+    },
     "CScript": { 
         "process_name": ["cscript.exe"]
     },
+    "mshta": {
+        "process_name": ["mshta.exe"]
+    },
+    "hh":{
+        "process_name": ["hh.exe"]
+    }, 
+    "Diskshadow": {
+        "process_name":["diskshadow.exe"]
+    }, 
+    "PHP":{
+        "process_name":["php.exe", "php-cgi.exe"]
+    },
     "Python": { 
         "process_name": ["python*.exe",
                          "python*"]
@@ -33,10 +48,17 @@
                          "sh",
                          "bash",
                          "zsh"]
-    }
+    },
+    "msbuild":{
+        "process_name":["msbuild.exe"]
+    }, 
+    "GPscript.exe":{
+        "process_name":["gpscript.exe"]
+    },
     "AutoHotKey": { 
         "process_name": ["autohotkey.exe",
                         "AutoHotkeyU32.exe",
                         "AutoHotkeyA32.exe",
                         "AutoHotkeyU64.exe"]      
+    }
 }