VBScript profiler recon via WMI process/host enumeration and Shell.Application directory listing

Ibrahim Saud@tektrix

•updated Jul 2, 2026•4•0•3

Detects the execution of WScript.exe invoking discovery-related WMI objects or common system enumeration commands such as 'tasklist'. This activity is often associated with initial reconnaissance, environmental discovery, or script-based malware post-compromise.