Wscript //e:vbscript Extension Masquerade Script Execution (Kimsuky)

Ibrahim Saud@tektrix

•updated Jul 2, 2026•0•0•2

Detects the use of WScript.exe to execute non-script extensions (e.g., .ini, .dat, .txt) as VBScript. Adversaries often use this technique to bypass file extension restrictions or execute obfuscated payloads by forcing a non-executable file type to be parsed by the Windows Scripting Host.