Archive Extraction Followed by VBScript Execution

Ankit Mehta@Secvyn

•updated Jun 23, 2026•0•0•2

This rule detects suspicious activity where a common archive utility (7z, WinRAR, unrar, winzip) extracts files, and within a 5-minute window, a VBScript interpreter (wscript.exe or cscript.exe) executes a script. This pattern is often associated with phishing attacks that deliver malicious VBScripts via archived files.