Multiple VBScript Executions with Suspicious Keywords
This rule detects multiple executions of VBScript or VBE files via wscript.exe or cscript.exe within a one-hour window, where the command line contains keywords commonly associated with malicious documents or phishing attempts (e.g., 'Invoice', 'Bill', 'Urgent', 'Payment'). This behavior can indicate user execution of a malicious script, often delivered via phishing.
Microsoft Sentinel (KQL)
