Suspicious Multiple VBScript Executions with Document-like Command Line Arguments

nomit vyas@xoxo

•updated Jun 25, 2026•0•0•2

Detects multiple executions of WScript.exe or CScript.exe within a single hour on the same device where the command line arguments contain document-related keywords such as Invoice, Bill, or Payment, and the file extension ends in .vbs or .vbe. This pattern often indicates mass execution of malicious scripts often delivered via email attachments or phishing lures.