VBScript Auto-Executed from User Startup Folder via wscript.exe

Subhankar H@Andrewsec57

•updated Jul 6, 2026•0•0•4

Detects the execution of a VBScript file using wscript.exe, where the script is located in the user's Startup folder. This pattern is commonly used by malware to maintain persistence by ensuring the script executes automatically upon user logon.