Suspicious WScript Execution From Public Directory

Duo Tech@duotech

•updated Jun 9, 2026•0•0•2

Detects wscript.exe (or cscript.exe) executing a JavaScript file from the C:\Users\Public\ directory. This behavior is indicative of the relocated JScript loader stage observed in a recent malspam .NET loader campaign.