SocGholish Browser Process Spawning Script Interpreter (T1059.007)

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects the spawning of Windows Script Host (wscript.exe or cscript.exe) as a child process of common web browsers (chrome.exe, msedge.exe, firefox.exe). This pattern is often indicative of a drive-by download attack or a user executing a malicious script file downloaded from the internet.