Skip to content
Threat Feed
Subscribe

Tag

Script

3 briefs RSS
medium advisory

Suspicious PowerShell Execution via Windows Script Host

Detection of PowerShell processes launched by cscript.exe or wscript.exe, indicative of potential malicious initial access or execution attempts.

Microsoft Defender XDR +2 initial-access execution windows powershell script
2r 4t
high threat

Suspicious Script Execution from Temporary Directory

This brief covers a detection for suspicious script execution, such as PowerShell, WScript, or MSHTA, originating from common temporary directories, potentially indicating malware activity.

exploited Windows execution script temp
2r 1t
medium advisory

Execution of a Downloaded Windows Script

This rule detects the execution of a Windows script downloaded from the internet, a technique adversaries may leverage for initial access and execution by using browsers or file utilities to download scripts and subsequently execute them with scripting tools like wscript or mshta.

Windows execution script initial_access
3r 7t