LOLBin wscript.exe/cscript.exe Script Execution from User-Writable Path
Detects the execution of Windows script files (JS, VBS, HTA) using wscript.exe or cscript.exe from common staging areas like AppData, Temp, or ProgramData, specifically when the initiating process is not a signed Microsoft binary. This pattern is highly indicative of potential malicious script execution often used in phishing delivery or secondary payload stages.
SentinelOne
