Double-extension .pdf.vbs launched by wscript.exe

Ibrahim Saud@tektrix

•updated Sep 23, 2026•1•0•2

Detects the execution of a .vbs script file that contains '.pdf' in its filename, followed within 5 minutes by the execution of a WMI query via wscript.exe. This behavior is indicative of a malicious VBScript dropper attempting to perform system discovery using WMI.