VBScript wscript.exe Directory Enumeration via Shell.Application Namespace Traversal

Ibrahim Saud@tektrix

•updated Jul 2, 2026•0•0•0

Detects the execution of wscript.exe using VBScript features such as 'FileSystemObject' and 'Shell.Application' to perform directory enumeration. This pattern is commonly observed in malicious scripts used by threat actors, such as Kimsuky, to discover files and system information during the reconnaissance phase of an attack.