Script host WMI locale/environment query preceding decoy notification

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•2

Detects the execution of Windows Script Host (wscript.exe/cscript.exe) loading WMI-related modules (wbemprox.dll, wbemcomn.dll, etc.). This pattern is often indicative of scripts attempting to query WMI for system information, environment configuration, or locale data, which is a common reconnaissance technique used by malware to identify the victim environment.