Suspicious VBScript Execution with Financial Keywords
This rule detects suspicious execution of VBScript or VBE files via wscript.exe or cscript.exe where the command line contains keywords commonly associated with financial documents or urgent requests. A high count of such executions from a single device within an hour is flagged, indicating potential malicious activity like phishing or malware delivery.
Microsoft Sentinel (KQL)
