WSF File Launching Batch Scripts

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•8

Detects Windows Script File (.wsf) scripts launching hidden batch (.bat) scripts via cmd.exe. This activity is often part of the ClickFix delivery chain, where wscript.exe (the host for .wsf files) initiates a command prompt to execute a batch file.