VBScript Execution From Public Directory

Shikha Sangwan@ssangwan

•updated Mar 30, 2026•0•42

Detects the execution of VBScript files via wscript.exe or cscript.exe originating from the C:\Users\Public\ directory. This behavior is highly suspicious and indicative of malware staging, as observed in the FAUX#ELEVATE campaign.