PowerShell spawned from wscript/cscript retrieving remote payloads

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•2

Detects instances where WScript.exe or CScript.exe spawn PowerShell.exe as a child process. The rule specifically looks for command-line arguments indicative of policy bypass (-ExecutionPolicy Bypass) and remote payload retrieval (Invoke-WebRequest, DownloadString), which is a common pattern in obfuscated JavaScript-based infection chains.