Suspicious Multiple VBScript Execution with Business-Related Keywords

nomit vyas@xoxo

•updated Jun 25, 2026•0•0•1

Detects frequent execution (3 or more within an hour) of .vbs or .vbe scripts via wscript.exe or cscript.exe where the command line contains keywords suggestive of lure documents such as invoices, payments, or reports. This behavior is commonly associated with malware droppers or phish-delivered scripts.