Skip to content
Threat Feed

Product

Cmd

1 brief RSS
high advisory

Command and Scripting Interpreter via Windows Scripts

This rule detects the execution of PowerShell, PowerShell ISE, or Cmd spawned from Windows Script Host or MSHTA, indicating potential abuse of scripting interpreters to execute malicious commands or scripts on Windows systems.

Microsoft Defender XDR +8 execution scripting windows
2r 1t