wscript.exe executing dropped VBScript stager from CHM lure
Detects the execution of VBScript files using wscript.exe with the /B (batch) flag when the file is located within user-specific directories such as AppData, Temp, or user profiles. This pattern is commonly used by malware and loaders to execute scripts stealthily in user-writable locations.
Splunk (SPL)
