Script Interpreter Execution From Suspicious Folder

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

Detects the execution of script interpreters (cscript.exe, mshta.exe, wscript.exe) with suspicious command-line flags or from temporary folders or folders accessible by environment variables, which is a common technique used by adversaries for execution and persistence.