---
title: Suspicious VBScript Execution via WScript or CScript
id: 9a5c3d21-1e4b-4c8a-9f2d-7a6b5c4d3e2f
status: experimental
description: Detects the execution of VBScript files by WScript or CScript, often used in malicious resume campaigns.
references:
  - https://thehackernews.com/2026/03/hackers-use-fake-resumes-to-steal.html
author: Security Arsenal
date: 2026/03/29
tags:
  - attack.initial_access
  - attack.t1566.001
  - attack.execution
  - attack.t1059.005
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
    CommandLine|contains:
      - '.vbs'
      - '.vbe'
  filter:
    ParentImage|contains: '\Program Files\'
condition: selection and not filter
falsepositives:
  - Legitimate system administration scripts
level: medium
---
title: Obfuscated PowerShell Command Execution
id: b8e4d6c2-3a1f-4b5e-8d9c-1a2b3c4d5e6f
status: experimental
description: Detects highly obfuscated PowerShell commands often spawned by VBScript droppers to download payloads.
references:
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2026/03/29
tags:
  - attack.execution
  - attack.t1059.001
  - attack.defense_evasion
  - attack.t1027
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - 'FromBase64String'
      - 'EncodedCommand'
      - 'Invoke-Expression'
      - 'IEX'
  condition: selection
falsepositives:
  - Legitimate administrative scripts using encoding
level: high
---
title: Suspicious Process Spawned by Microsoft Office
id: c7f3e9d1-4b2a-5c6e-9d0a-2b1c3d4e5f6a
status: experimental
description: Detects Microsoft Word or Excel spawning WScript or PowerShell, a common technique in malicious document campaigns.
references:
  - https://attack.mitre.org/techniques/T1566/001/
author: Security Arsenal
date: 2026/03/29
tags:
  - attack.initial_access
  - attack.t1566.001
  - attack.execution
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    Image|contains:
      - '\WINWORD.EXE'
      - '\EXCEL.EXE'
      - '\POWERPNT.EXE'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate macro-enabled business documents
level: high

// Hunt for VBScript execution from user directories
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("wscript.exe", "cscript.exe")
| where ProcessCommandLine has ".vbs" 
| where InitiatingProcessFileName !in~ ("explorer.exe", "cmd.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, FolderPath
| order by Timestamp desc


// Detect potential crypto mining process characteristics (High CPU/Rare Image)
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("powershell.exe", "cmd.exe", "wscript.exe")
| where ProcessCommandLine has_any ("download", "iex", "invoke-expression", "frombase64string")
| join kind=inner (DeviceNetworkEvents
| where RemotePort in (3333, 4444, 8080, 14444) // Common mining pools or C2 ports
| project DeviceId, RemoteUrl, RemoteIP) on DeviceId
| project Timestamp, DeviceName, FileName, ProcessCommandLine, RemoteUrl, RemoteIP

-- Hunt for VBScript files in user downloads or desktop directories
SELECT FullPath, Size, Mtime, Atime, Mode
FROM glob(globs="C:/Users/*/Downloads/*.vbs")

UNION ALL

SELECT FullPath, Size, Mtime, Atime, Mode
FROM glob(globs="C:/Users/*/Desktop/*.vbs")


-- Detect recent execution of wscript.exe or cscript.exe
SELECT Pid, Name, CommandLine, Exe, StartTime, Username
FROM pslist()
WHERE Name =~ "wscript" OR Name =~ "cscript"

-- Cross-reference with network connections to identify potential C2 or Mining pools
SELECT P.Name, P.CommandLine, N.RemoteAddress, N.RemotePort
FROM pslist() AS P
LEFT JOIN each(process=Pid, query={
    SELECT RemoteAddress, RemotePort
    FROM listen()
}) AS N
WHERE P.Name =~ "wscript" OR P.Name =~ "cscript"

<#
.SYNOPSIS
    Scans for suspicious VBScript files created in the last 24 hours.
.DESCRIPTION
    This script searches User Profiles for .vbs files modified recently and outputs the findings.
#>

$TimeThreshold = (Get-Date).AddDays(-1)
$SuspiciousPaths = @(
    "$env:USERPROFILE\Downloads",
    "$env:USERPROFILE\Desktop",
    "$env:USERPROFILE\Documents",
    "C:\Users\*\Downloads",
    "C:\Users\*\Desktop"
)

Write-Host "Scanning for VBScript files created or modified after: $TimeThreshold" -ForegroundColor Cyan

foreach ($Path in $SuspiciousPaths) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Filter *.vbs -Recurse -ErrorAction SilentlyContinue | 
        Where-Object { $_.LastWriteTime -gt $TimeThreshold -or $_.CreationTime -gt $TimeThreshold } | 
        Select-Object FullName, LastWriteTime, CreationTime, Length | 
        Format-Table -AutoSize
    }
}

Write-Host "Scan complete." -ForegroundColor Green