WScript Executed from User Ring

Marcus Mingo@meeengoh

•updated Oct 18, 2025•1•0•71

Detects Windows Script Host (wscript.exe) or masquerading binaries executing JavaScript (.js) files from user-writable paths such as C:\Users\ or C:\ProgramData\. This behavior is commonly associated with phishing payloads, malware droppers, or persistence mechanisms that execute user-space scripts. The rule covers both legitimate wscript.exe and renamed or spoofed variants.