Detect Wscript/Cscript Executing JavaScript, VBScript, VBA/VBE, WSF/WSH Files on Windows

Flags wscript.exe or cscript.exe executing common script file types via command-line extensions on Windows.

FreeUnreviewedSigmamediumv1

detect-wscript-cscript-executing-javascript-vbscript-vba-vbe-wsf-wsh-files-on-wi-1e33157c

title: Detect Wscript/Cscript Executing JavaScript, VBScript, VBA/VBE, WSF/WSH Files on Windows
id: 99cfe7a1-7c7b-4077-ab80-69bad2d72a1a
related:
  - id: 23250293-eed5-4c39-b57a-841c8933a57d
    type: obsolete
  - id: cea72823-df4d-4567-950c-0b579eaf0846
    type: derived
  - id: 1e33157c-53b1-41ad-bbcc-780b80b58288
    type: derived
status: test
description: This rule identifies Windows process creation where wscript.exe or cscript.exe launches and the command line contains script file extensions such as .js, .jse, .vba, .vbe, .vbs, .wsf, or .wsh. Attackers commonly use these Microsoft script hosts to execute script-based payloads while blending into legitimate Windows tooling. The detection relies on Windows process creation telemetry including the process image name and the full command line arguments.
references:
  - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/
  - https://redcanary.com/blog/gootloader/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_wscript_cscript_script_exec.yml
author: Michael Haag, Huntrule Team
date: 2019-01-16
modified: 2026-02-17
tags:
  - attack.execution
  - attack.t1059.005
  - attack.t1059.007
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - OriginalFileName:
        - wscript.exe
        - cscript.exe
    - Image|endswith:
        - \wscript.exe
        - \cscript.exe
  selection_cli:
    CommandLine|contains:
      - .js
      - .jse
      - .vba
      - .vbe
      - .vbs
      - .wsf
      - .wsh
  condition: all of selection_*
falsepositives:
  - Some additional tuning is required. It is recommended to add the user profile path in CommandLine if it is getting too noisy.
level: medium
license: DRL-1.1

What it detects

This rule identifies Windows process creation where wscript.exe or cscript.exe launches and the command line contains script file extensions such as .js, .jse, .vba, .vbe, .vbs, .wsf, or .wsh. Attackers commonly use these Microsoft script hosts to execute script-based payloads while blending into legitimate Windows tooling. The detection relies on Windows process creation telemetry including the process image name and the full command line arguments.

Known false positives

Some additional tuning is required. It is recommended to add the user profile path in CommandLine if it is getting too noisy.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.