Script File Execution via Wscript or Cscript
This rule detects the execution of script files with extensions such as .js, .jse, .vba, .vbe, .vbs, and .wsf by the Windows Script Host executables, Wscript.exe or Cscript.exe. This activity is often associated with malicious script execution, including those delivered via phishing or used in post-exploitation phases.
Sigma
