WScript or CScript Dropper - File Creation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•20

Detects the creation of script files (JSE, VBE, JS, VBA, VBS) in common user or program data directories by wscript.exe or cscript.exe. This behavior is often associated with malware droppers or initial access techniques.