Gamaredon HTA/VBScript Delivery via mshta.exe and wscript.exe Spawning Script Engines

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•2

Detects the execution of script interpreters (mshta, wscript, cscript) or PowerShell initiated by Microsoft Office applications (Word, Excel, PowerPoint, Outlook). This pattern is a common indicator of malicious macro or embedded script execution, often used to deliver secondary payloads.