Suspicious VBScript Execution via WScript/CScript

nomit vyas@xoxo

•updated Jun 25, 2026•0•0•2

This rule detects suspicious usage of Windows Script Host (wscript.exe or cscript.exe) by monitoring for the execution of VBScript files containing keyword-heavy command lines related to common phishing themes (e.g., 'Invoice', 'Payment', 'Urgent'). It flags when a specific device executes three or more such scripts within a one-hour window, which is indicative of potential bulk file processing or automated malicious activity typical of dropper or downloader malware.