Suspicious VBScript Execution with Financial Keywords

nomit vyas@xoxo

•updated Jun 24, 2026•0•0•4

This rule detects suspicious execution of VBScript or VBE files via wscript.exe or cscript.exe where the command line contains keywords commonly associated with financial documents or urgent requests. A high count (3 or more) of such events from a single device within an hour is considered anomalous, potentially indicating a phishing attempt or malware execution.