Wscript/Cscript Execution with Uncommon File Extension
Detects Wscript or Cscript executing a file with an uncommon (i.e., non-script) extension such as .csv, .dat, .doc, .gif, .jpeg, .jpg, .png, .ppt, .txt, .xls, or .xml. This technique can be used by adversaries to bypass application control or obscure malicious script execution.
Sigma
