Browser-Spawned WSCRIPT/CSCRIPT Execution of .vbs Downloader (Ousaban)
This rule detects scenarios where common web browsers (Firefox, Chrome, Edge, IE) launch Windows scripting hosts (wscript.exe or cscript.exe) to execute .vbs files. This behavior is highly characteristic of drive-by download attacks or malicious browser-based content attempting to execute local scripts for further exploitation.
Microsoft Sentinel (KQL)
