Script Host Execution with Suspicious Extensions

Jason Nelson@Jason

•updated Jul 21, 2025•8•3•89

Detects Windows Script Host execution of suspicious file types from browsers, often used in FileFix attacks to execute malicious VBScript or JScript files.