Suspicious VBScript Execution with Financial Keywords

nomit vyas@xoxo

•updated Jun 24, 2026•0•0•2

This rule detects suspicious execution of VBScript (.vbs or .vbe) files via wscript.exe or cscript.exe where the command line contains keywords commonly associated with financial documents or urgent notifications. A high count (3 or more) of such events from a single device within an hour is flagged to reduce false positives.