cscript.exe

Overview

cscript.exe is the console-based host for Windows Script Host (WSH).

It executes script files including:

Unlike wscript.exe, which executes scripts in a graphical environment, cscript.exe executes them within a console session. This makes it more suitable for automation, scheduled tasks, deployment workflows, and administrative scripting. 【1-60ec38】

Expected Characteristics

Expected Locations

Expected Parents

Common examples include:

Typical Profile

Why This Matters

cscript.exe is one of the most commonly abused scripting hosts on Windows.

The same features that make it attractive for administrators also make it attractive for attackers.

Common malicious uses include:

Because cscript.exe is a legitimate Windows binary, malicious activity can easily blend into normal administrative operations. 【1-60ec38】

Investigation Objective

Determine:

In most investigations, the script itself is far more important than cscript.exe.

Normal Behaviour

Characteristics

Path

Signature

Parent Processes

Common examples include:

Children

Usually none.

Where child processes exist, they should align with a documented administrative workflow.

Lifetime

Typical Activity

Legitimate examples include:

Expected Behavioural Characteristics

Legitimate scripts typically:

Abuse Patterns

Untrusted Script Locations

Investigate scripts executed from:

User-writeable locations are commonly used by malware and phishing payloads. 【1-60ec38】

Suspicious Parent Processes

Investigate cscript.exe launched by:

These relationships frequently indicate user execution or malware staging activity.

Suspicious Child Processes

Investigate cscript.exe launching:

powershell.exe

cmd.exe

mshta.exe

rundll32.exe

regsvr32.exe

wscript.exe

curl.exe

bitsadmin.exe

Any multi-stage execution chain deserves investigation.

Obfuscation Indicators

Investigate command lines containing:

Heavy obfuscation generally indicates an attempt to evade analysis.

COM Object Abuse

Cscript-based malware frequently creates objects such as:

WScript.Shell

ADODB.Stream

MSXML2.XMLHTTP

WinHttp.WinHttpRequest

These objects are commonly abused to:

Fileless Execution

Investigate scripts that:

The absence of disk artefacts should not lower investigative priority.

Persistence Activity

Investigate scripts that:

Many malware families use scripts during persistence setup.

Detection Opportunities

Script Execution Monitoring

Monitor:

The script path frequently provides the strongest signal.

Parent Process Analytics

Useful detections include:

outlook.exe
    → cscript.exe

winword.exe
    → cscript.exe

browser.exe
    → cscript.exe

These process chains are uncommon during normal business activity.

Child Process Monitoring

Alert on:

cscript.exe
    → powershell.exe

cscript.exe
    → rundll32.exe

cscript.exe
    → regsvr32.exe

cscript.exe
    → mshta.exe

These relationships commonly appear in malware execution chains.

Script Content Inspection

Where available:

Content analysis often determines legitimacy immediately.

LOLBin Chaining

Investigate:

Legitimate administrative workflows rarely require extensive LOLBin chaining.

Hunting Opportunities

Useful hunting pivots include:

Focus on rarity rather than volume.

False Positives

Legitimate script execution still occurs in many enterprise environments.

Common Legitimate Scenarios

Examples include:

Validation Questions

Check:

Estate Context

Legitimate scripts often:

Administrative Activity

Review:

Many false positives occur during enterprise management operations.

Hardening Recommendations

Reduce Legacy Script Usage

Identify and retire:

Reducing WSH dependence reduces attack surface.

Application Control

Consider:

Prevent execution of unapproved scripts.

Restrict User-Writeable Execution

Reduce script execution opportunities from:

These locations appear frequently in malware delivery chains.

Disable WSH Where Practical

In tightly controlled environments, evaluate whether:

Many organisations retain WSH solely for historical reasons.

Monitor Script Hosts

Maintain visibility into:

These binaries frequently appear together.

Defensive Validation

Regularly test:

Controls should be validated using realistic attack chains.

Triage Checklist

Identity and Integrity

Lineage and Behaviour

Script Context

Scope and Correlation

Escalation Considerations

Escalate immediately when:

ATT&CK References

Windows Processes

Windows Script Host

MITRE ATT&CK