Question Analysis
On a Windows endpoint, wscript.exe was used to run a JScript. Identify the exact script path passed to wscript.
0709945e-4fec-4c49-9faf-c3c292a74484
Question ID
10/16
Models Correct
1
Valid Answer
63%
Success Rate
Reference Answer
Human-validated correct answer for this question
PathToAtomicsFolder\T1059.007\src\sys_info.js
Model Performance Comparison
See how different AI models performed on this question
| Model | Answer | KQL Query | Status | Attempts | Time | Cost |
|---|---|---|---|---|---|---|
| gemini-2.5-flash-preview-04-17 | C:\AtomicRedTeam\atomics\T1059.007\src\sys_info.js | DeviceProcessEvents
| where FileName =~ "wscript.exe"
| project Timestamp, DeviceName, ProcessCommandLine | Correct | 1 | 5.54s | 0.0022 |
| gpt-35-turbo | No answer provided | No query generated | Incorrect | 5 | 0.00s | 0.0108 |
| gpt-4-turbo-2024-04-09 | C:\AtomicRedTeam\atomics\T1059.007\src\sys_info.js | DeviceProcessEvents
| where FileName == 'wscript.exe' and ProcessCommandLine has ".js"
| project DeviceName, ProcessCommandLine, TimeGenerated
| distinct DeviceName, ProcessCommandLine, TimeGenerated | Correct | 1 | 11.76s | 0.0508 |
| gpt-4.1 | C:\AtomicRedTeam\atomics\T1059.007\src\sys_info.js | DeviceProcessEvents
| where tolower(FileName) == "wscript.exe"
| where ProcessCommandLine has_any (".js", ".jse")
| extend PathRegex = @'("[^"]+\.js[e]?"|\S+\.js[e]?)'
| extend ScriptPath = extract(PathRegex, 0, ProcessCommandLine)
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, ScriptPath
| where isnotempty(ScriptPath) | Correct | 3 | 15.63s | 0.0263 |
| gpt-4.1-finetuned | No answer provided | No query generated | Incorrect | 5 | 0.00s | 0.0440 |
| gpt-4.1-mini | No answer provided | No query generated | Incorrect | 5 | 0.00s | 0.0086 |
| gpt-4.1-nano | No answer provided | No query generated | Incorrect | 5 | 0.00s | 0.0016 |
| gpt-4o | No answer provided | No query generated | Incorrect | 5 | 0.00s | 0.0589 |
| grok-3-beta | C:\AtomicRedTeam\atomics\T1059.007\src\sys_info.js | DeviceProcessEvents
| where FileName == 'wscript.exe'
| where ProcessCommandLine has '.js' or ProcessCommandLine has '.jse'
| extend ScriptPath = extract('(?:[^"]\\S+\\.js[e]?|[^"\\s]+\\.js[e]?)', 0, ProcessCommandLine)
| project DeviceName, Timestamp, ProcessCommandLine, ScriptPath
| order by Timestamp desc | Correct | 1 | 11.38s | 0.0211 |
| grok-3-mini-beta | C:\AtomicRedTeam\atomics\T1059.007\src\sys_info.js | DeviceProcessEvents
| where FileName =~ "wscript.exe"
| where ProcessCommandLine contains ".js"
| extend scriptPath = extract(@"wscript\.exe\s+([^\s]+)", 1, ProcessCommandLine, typeof(string))
| project Timestamp, DeviceName, ProcessCommandLine, scriptPath
| order by Timestamp desc | Correct | 2 | 23.51s | 0.0030 |
| o1-high | C:\AtomicRedTeam\atomics\T1059.007\src\sys_info.js | DeviceProcessEvents
| where FileName =~ "wscript.exe"
| where ProcessCommandLine has ".js"
| extend ScriptPath = extract("(\"[^\"]+\\.js\"|\\S+\\.js)", 1, ProcessCommandLine)
| extend ScriptPath = trim("'", trim("\"", ScriptPath))
| project TimeGenerated, DeviceName, ScriptPath, ProcessCommandLine, AccountName, AccountDomain | Correct | 3 | 96.92s | 0.6185 |
| o1-low | C:\AtomicRedTeam\atomics\T1059.007\src\sys_info.js | DeviceProcessEvents
| where FileName =~ "wscript.exe"
| where ProcessCommandLine contains ".js" or ProcessCommandLine contains "JScript"
| extend ScriptPath = extract(@'wscript\.exe\s+("[^"]+"|\S+)', 1, ProcessCommandLine)
| project DeviceName,
TimeGenerated,
ScriptPath,
ProcessCommandLine,
InitiatingProcessAccountName,
AccountName
| order by TimeGenerated desc | Correct | 5 | 126.68s | 0.9837 |
| o3-mini-high | C:\AtomicRedTeam\atomics\T1059.007\src\sys_info.js | DeviceProcessEvents
| where FileName =~ "wscript.exe"
| where ProcessCommandLine contains ".js"
| extend ScriptPath = extract(@'([A-Za-z]:\\(?:[^\\/:*?"<>|\r\n]+\\)*[^\\/:*?"<>|\r\n]+\.js)', 1, ProcessCommandLine)
| where isnotempty(ScriptPath)
| project TimeGenerated, DeviceName, ScriptPath, ProcessCommandLine
| order by TimeGenerated desc | Correct | 1 | 37.20s | 0.0080 |
| o3-mini-low | C:\AtomicRedTeam\atomics\T1059.007\src\sys_info.js | DeviceProcessEvents
| where FileName has_cs "wscript.exe"
| where ProcessCommandLine has_cs ".js"
| extend ScriptPath = extract(@"wscript\.exe\s+([^\s]+\.js)", 1, ProcessCommandLine)
| project TimeGenerated, DeviceName, ScriptPath, ProcessCommandLine
| order by TimeGenerated desc | Correct | 2 | 43.90s | 0.0175 |
| o4-mini-high | No answer provided | No query generated | Incorrect | 5 | 0.00s | 0.0359 |
| o4-mini-low | C:\AtomicRedTeam\atomics\T1059.007\src\sys_info.js | DeviceProcessEvents
| where FileName == "wscript.exe"
| where ProcessCommandLine has ".js"
| extend ScriptPath = extract(@"([A-Za-z]:\\[^ \r\n]+?\.js)", 1, ProcessCommandLine)
| where isnotempty(ScriptPath)
| project TimeGenerated, DeviceName, User = InitiatingProcessAccountName, ProcessCommandLine, ScriptPath
| order by TimeGenerated desc | Correct | 3 | 92.33s | 0.0298 |