Suspicious VBScript Execution Patterns

nomit vyas@xoxo

•updated Jun 25, 2026•0•0•3

Detects frequent execution of VBScript files using wscript.exe or cscript.exe where the command-line arguments contain suspicious keywords often associated with phishing lures or malicious documents. The rule triggers when a single device executes three or more such processes within a one-hour window.