Wscript or Cscript Suspicious Child Process Execution

This analytic identifies suspicious child processes spawned by `WScript.exe` or `CScript.exe`. Adversaries and malware commonly use these scripting hosts to execute various Living Off the Land Binaries (LOLBINs), other scripts like PowerShell, or to spawn suspended processes for code injection as a defense evasion technique. While this TTP may detect some legitimate scripts that utilize the listed child processes, it serves as a strong indicator that a script might be executing suspicious code.