Suspicious VBScript Execution with Financial Keywords
Detects suspicious execution of VBScript (.vbs, .vbe) files via wscript.exe or cscript.exe where the command line contains keywords commonly associated with financial documents or urgent notifications. This rule specifically looks for multiple such executions within a one-hour window from the same device, which could indicate a targeted phishing attempt or malware activity.
Microsoft Sentinel (KQL)
