Suspicious WScript/CScript Execution with VBS/VBE and Keyword Match

nomit vyas@xoxo

•updated Jun 24, 2026•0•0•2

This rule detects suspicious execution of wscript.exe or cscript.exe that involves VBScript or VBE files and contains keywords commonly associated with financial documents or urgent notifications in the command line. A high count (3 or more) of such events from a single device within an hour is considered anomalous, potentially indicating phishing attempts or malware execution.