VBScript Command Line Obfuscation Detection

Ankit Mehta@Secvyn

•updated Jun 23, 2026•0•0•2

Detects the execution of VBScript (wscript.exe or cscript.exe) with a command line containing common obfuscation techniques such as 'chr(', 'asc(', 'Replace(', 'Split(', 'Join(', or 'char_code_at', and a command line length greater than 500 characters. This pattern is often used in phishing campaigns to hide malicious code.