wscript.exe

Overview

wscript.exe is the graphical Windows Script Host (WSH) executable.

It executes:

Unlike cscript.exe, which provides a console-based interface, wscript.exe executes scripts in a windowed environment and can display dialogs and message boxes.

Expected Characteristics

Expected Locations

Expected Parents

Common examples include:

Typical Profile

Why This Matters

Attackers have abused Windows Script Host for decades.

wscript.exe remains useful because it can:

Common attack chains involve:

Investigation Objective

Determine:

Normal Behaviour

Characteristics

Path

Signature

Parent Processes

Common examples include:

Children

Usually none.

Child processes should align with known administrative workflows.

Script Types

Common examples include:

Typical Activity

Expected Behavioural Characteristics

Legitimate WSH usage typically:

Abuse Patterns

Suspicious Script Locations

Investigate scripts launched from:

Most malicious WSH activity originates from user-controlled or transient locations. 【1-52245b】

Unexpected Parent Processes

Investigate wscript.exe launched by:

These relationships are frequently observed during phishing and malware delivery.

Child Process Abuse

Investigate wscript.exe spawning:

powershell.exe

cmd.exe

mshta.exe

rundll32.exe

regsvr32.exe

cscript.exe

unsigned executables

This commonly indicates staged execution.

Obfuscated Scripts

Investigate:

The more effort spent hiding script contents, the more scrutiny the script deserves.

COM Object Abuse

Look for:

WScript.Shell

ADODB.Stream

MSXML2.XMLHTTP

These are frequently used to:

Fileless Execution

Investigate:

The absence of a traditional payload does not imply benign behaviour.

Persistence Activity

Review execution that:

WSH is commonly used during persistence setup.

Detection Opportunities

Script Execution Monitoring

Monitor:

The script itself often provides more value than the host process.

Parent Process Analytics

Investigate:

These process chains frequently indicate malicious user execution.

Child Process Analytics

Monitor for:

spawned by wscript.exe.

Unexpected child processes frequently provide high-confidence signals.

Command-Line Analytics

Investigate:

Command lines often reveal execution intent.

COM Object Monitoring

Useful pivots include:

These are commonly used by malicious scripts.

Hunting Opportunities

Useful hunting pivots include:

False Positives

Legitimate WSH activity still exists in many environments.

Common Legitimate Scenarios

Examples include:

Validation Questions

Check:

A legitimate script usually has a known business purpose and consistent deployment history.

Estate Context

Legitimate scripts are often:

Hardening Recommendations

Reduce Reliance on Legacy Scripts

Identify:

Reducing WSH usage makes malicious activity easier to identify.

Application Control

Consider:

Restrict unauthorised script execution.

Restrict User-Writable Script Execution

Reduce execution opportunities from:

Many malicious scripts depend on these paths.

Monitor Script Host Activity

Maintain visibility into:

Attackers frequently chain these tools together.

Script Governance

Maintain inventories of:

Unknown scripts should be investigated.

Defensive Validation

Regularly test:

Triage Checklist

Identity and Integrity

Lineage and Behaviour

Script Context

Scope and Correlation

Escalation Considerations

Escalate when:

ATT&CK References

Windows Processes

Windows Script Host

MITRE ATT&CK