How can security teams detect CostaBricks?

How CostaBricks typically shows up on the endpoint

Detection starts with the execution pattern, not the payload name. CostaBricks is easier to spot when JavaScript runs from an unusual context, such as an email attachment, archive extractor, browser download, or Office child process, and then immediately spawns a scripting host or other helper process. That sequence is often more telling than a single file hash.

Look for script content that is obfuscated, minified beyond normal business use, or embedded in places where script should not normally execute. Dropped files in user-writable paths, followed by interpreter activity, are especially useful because they often indicate staging rather than routine user behavior.

When the browser, email client, or document handler launches a script engine and the next step is outbound network activity, that chain becomes a high-value hunting signal. It helps separate ordinary browsing from malware staging, downloader behavior, or post-delivery execution.

What telemetry is most useful for confirming it

Endpoint telemetry gives the strongest first pass, but it should be paired with network visibility. Process creation logs, command-line logging, module loads, and file-write events can show where the script came from and what it launched. Web proxy and DNS logs then confirm whether the host reached out shortly after script execution.

That pairing matters because CostaBricks-like activity often uses a short local execution chain before reaching infrastructure. If endpoint alerts show a browser or email attachment launching script activity, and proxy or DNS telemetry shows fresh outbound connections to unfamiliar destinations, the combined signal is much stronger than either source alone.

In practice, the most useful confirmation is a timeline: initial user-facing application, script execution, file drop or decode step, then network contact. When those steps line up within a short window, the event is more likely to be malicious than an isolated scripting event.

How to separate suspicious activity from normal admin or automation use

Not every script launch is malicious, so the real discriminator is context. Administrative scripts usually come from known locations, signed tooling, scheduled jobs, or approved automation paths. CostaBricks-style detection focuses on script execution that begins from a user interaction path and then shifts into staging, decoding, or download behavior that the environment does not normally expect.

Pay close attention to process lineage. Office applications, browsers, archive handlers, and email clients rarely need to spawn scripting hosts for ordinary business work. When they do, the surrounding details matter: the parent process, the user context, the file location, the command line, and whether the script is followed by a network connection or file drop.

Obfuscation is another useful separator. Legitimate scripts may be compressed or minified, but they are less likely to contain layered decoding, string assembly, environment checks, or other concealment patterns that are commonly used to hide malicious logic.

Risk and Threat Considerations

CostaBricks-style activity is risky because it blends user-initiated execution with download and staging behavior, which can make the first malicious step look like ordinary file handling. That creates an opportunity for rapid payload delivery before a security team has enough context to intervene.

Failure mechanism: A script launched from a trusted user workflow can decode or retrieve the next-stage payload, write it into a user-writable location, and initiate outbound connections before obvious alerts appear. If detections focus only on the final payload, the earlier staging chain may be missed.

Impact: Missing the staging sequence can allow the actor to establish persistence, expand access, or deliver follow-on malware while the activity still looks like routine browser, email, or archive behavior. The practical loss is time, and in malware investigations time is often what prevents containment.

Practitioner Guidance

What to verify: Build hunts around the full chain, not just a single indicator. Verify parent-child process relationships, script host usage, file writes to user-writable paths, and outbound connections that occur immediately after script launch.

What to prioritise: Start with hosts where email attachments, browser downloads, or archive extraction precede script execution. Those are the most likely places to find a reliable staging path, especially when the endpoint alert aligns with proxy or DNS evidence.

Practitioner takeaway: The best detection path is behavioral correlation, a suspicious launch chain plus short-lived staging activity plus network contact is much more actionable than any one event on its own.

Related resources from NHI Mgmt Group

• Guide: Malware Guide
• Why are NHIs a critical concern for security teams?
• What steps should security teams take to prevent Shadow AI risks?
• Why is the abuse of NHIs a priority for security teams?
• What is the difference between SAST and DAST for security teams?