Double-extension VBScript dropper executed via wscript.exe

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•2

This rule detects the execution of script files (such as .vbs, .vbe, .js, .jse) via wscript.exe when the file name uses a double-extension technique (e.g., .pdf.vbs) to masquerade as a benign PDF document. These files are typically found in temporary or user-download directories, indicating potential malicious activity initiated by downloaded attachments.