Suspicious VBScript Execution with Financial Keywords
Detects suspicious execution of VBScript (.vbs, .vbe) files via wscript.exe or cscript.exe where the command line contains keywords commonly associated with financial documents or urgent notifications. This rule specifically looks for multiple such executions within a one-hour window from the same device, indicating potential malicious activity like phishing or malware delivery.
Microsoft Sentinel (KQL)
