CScript NTFS Shortname Execution

Tim Peck@timpeck

•updated Jan 19, 2026•5•0•80

Detects cscript.exe executing a JScript file using a legacy NTFS 8.3 shortname. This is a known technique used by Gootloader during its persistence phase to obfuscate the script's path and name.