PowerShell Spawned by WScript/CScript with Bypass Flags (Veil#Drop)

Ibrahim Saud@tektrix

•updated Sep 21, 2026•0•0•5

This rule detects instances where PowerShell is executed by a Windows Script Host process (wscript.exe or cscript.exe) using common suspicious command-line arguments. This pattern is frequently used by adversaries to execute obfuscated or bypassed PowerShell scripts while attempting to hide or proxy the execution through legitimate scripting host processes.