Browser-Spawned WSCRIPT/CSCRIPT Execution of .vbs Downloader (Ousaban)
Detects the execution of VBScript files (via wscript.exe or cscript.exe) where the parent process is a common web browser (Chrome, Firefox, Edge, or IE). This pattern is frequently indicative of a drive-by download or social engineering attack where a user is tricked into executing a malicious script originating from a web-based context.
Cortex XDR
