WScript/CScript Execution from Unusual Parent Process

nomit vyas@xoxo

•updated Jun 24, 2026•0•0•2

Detects the execution of wscript.exe or cscript.exe (Windows Script Host) from a parent process that is not commonly associated with legitimate script execution. This can indicate malicious script execution, potentially bypassing security controls or being part of an initial access or execution chain. Exclusions are made for common legitimate parent processes like explorer.exe, cmd.exe, powershell.exe, svchost.exe, system.exe, and web browsers.