[WINDOWS-SYSMON] JavaScript file executed after batch file

alert any $HOME_NET any -> $HOME_NET any (msg:"[WINDOWS-SYSMON] JavaScript file executed after batch file"; program:*Sysmon*; event_id:1; content:"CommandLine"; content:"WScript.exe"; nocase; distance:0; content:".js"; nocase; distance:0; content:"ParentCommandLine"; distance:0; content:"cmd.exe /c"; nocase; distance:0; content:".bat"; nocase; distance:0; content:!"
| 5c
| Synerion"; pcre:"/CommandLine\: [^\s]+WScript\.exe[^\s]+\.js.*ParentCommandLine\: [^\s]+cmd\.exe \/c .*\.bat/i"; reference:url,thedfirreport.com/2023/01/09/unwrapping-ursnifs-gifts/; classtype:trojan-activity; sid:5013796; rev:3; metadata:deployment Endpoint,affected_product NONE,affected_version NONE,mitigation NONE,deprecation_reason NONE,tag NONE, created_at 2023_02_01, updated_at 2023_02_01, mitre_tactic_id TA0002, mitre_technique_id T1059.007;)