Potential Dropper Script Execution via WScript/CScript from Suspicious Directories
Detects executions of WScript.exe or CScript.exe that are running scripts with common extensions (e.g., .js, .vbs) from suspicious temporary or public user directories. This behavior is often associated with dropper scripts used in initial access or malware delivery.
Sigma
