VBScript/JScript Remote or Temp Script Execution via cscript/wscript (T1059.005)

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•0

Detects the execution of VBScript, JavaScript, or HTA files via cscript.exe or wscript.exe when the script file originates from suspicious locations such as AppData, Temp, or via URL/network paths. The rule filters out scripts launched by known trusted publishers to minimize noise from legitimate system or application activity.