LinkedIn Recruitment Lure - mshta.exe or wscript.exe Spawned from Archive Extraction Path

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•2

Detects the execution of known script host binaries (mshta.exe, wscript.exe, cscript.exe) from suspicious user-writable directories (Downloads, Temp, AppData, Desktop). The detection specifically looks for these binaries when spawned by common applications like archive utilities (7-zip, WinRAR, WinZip) or shell interfaces (explorer.exe, cmd.exe, powershell.exe), which is a common pattern for the execution of downloaded or extracted malicious payloads.