Skip to content
Threat Feed

Tag

Wscript

1 brief RSS
high advisory

Suspicious Child Processes Spawned by WScript or CScript

Detects suspicious processes spawned by WScript or CScript, a common technique used by adversaries to execute LOLBINs, PowerShell, or inject code into suspended processes for defense evasion.

Splunk Enterprise +2 wscript cscript lolbin malware defense-evasion
2r 3t