WSF Script Execution from Suspicious Location

Ariel Ropek@arielkr

•updated Mar 10, 2026•1•0•32

Detects the execution of a Windows Script File (.wsf) from a suspicious or non-standard directory, such as temporary folders or removable/mounted drives. This technique was observed in the Dead#Vax campaign where a WSF file was executed from a mounted VHD to initiate the infection chain.