JS obfuscated indirect eval via string concat or unicode escape

Subhankar H@Andrewsec57

•updated Aug 24, 2026•0•0•1

Detects the execution of JavaScript files using WScript or CScript that contain obfuscated 'eval()' calls, such as string concatenation (e.g., (0,this)["ev"+"al"]) or Unicode escaping. Adversaries often use these techniques to bypass signature-based detection for malicious script execution.