wscript.exe executes .ini file as VBScript via //b //e:vbscript flags

Ethan Andrews@eandrews

•updated Jul 2, 2026•0•0•4

Detects the execution of wscript.exe with the //b and //e:vbscript flags, forcing the Windows Script Host to interpret a file as VBScript regardless of its file extension. This technique is used to bypass extension-based security controls, with documented use by the Kimsuky threat group.