Wscript.exe executes unsigned obfuscated JS file

Renata Cardoso@rcardososec

•updated Aug 10, 2026•1•0•2

Detects the execution of unsigned JavaScript (.js) files using the Windows Script Host (wscript.exe). Adversaries often use JavaScript for initial execution or as a secondary payload, and obfuscation is commonly applied to these scripts to evade detection.