Multiple Suspicious VBScript Executions via WScript or CScript

nomit vyas@xoxo

•updated Jun 25, 2026•0•0•14

Detects multiple executions of wscript.exe or cscript.exe within an hour that involve command-line arguments containing business-related keywords (e.g., Invoice, Payment) and script extensions (.vbs or .vbe). This behavior is often indicative of automated malware staging, such as malicious macro-enabled documents spawning script engines.