Skip to content
Threat Feed

Tag

Attack.t1059

1 brief RSS
high advisory

Suspicious Script Interpreter Execution from Environment Variable Folders

Adversaries may execute script interpreters such as cscript, wscript, mshta, or powershell from suspicious directories accessible via environment variables to evade detection and execute malicious scripts.

Windows attack.execution attack.t1059
2r 1t