Ceplin Command Identifier

Identifier / Programs / Windows

cscript.exe

Starts a script to run in a command-line environment. Windows commands reference

LOLBAS ADS, AWL Bypass 63 Sigma rules name it 4 ATT&CK techniques 1 documented command 14 known copies with hashes

Opens the identifier with your command. It is read in your browser and sent nowhere.

How cscript.exe is abused

documented by LOLBAS

ADS T1564.004 Hide Artifacts: NTFS File Attributes

AWL Bypass T1220 XSL Script Processing

Through winrm.vbs: get

-format

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for cscript.exe.

1 documented command

from LOLBAS, each read by the identifier

ADS T1564.004 Hide Artifacts: NTFS File Attributes User privileges

Use cscript.exe to exectute a Visual Basic script stored in an Alternate Data Stream (ADS).

cscript //e:vbscript {PATH_ABSOLUTE}:script.vbs
Identify

Trips 1 Sigma rule: mediumWSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript by Michael Haag

The command the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for cscript.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for cscript.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules
highCscript/Wscript Uncommon Script Extension ExecutionNasreddine Bencherchali (Nextron Systems)
mediumWSF/JSE/JS/VBA/VBE File Execution Via Cscript/WscriptMichael Haag
mediumPotential Dropper Script Execution Via WScript/CScript/MSHTAMargaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community, Nasreddine Bencherchali (Nextron Systems), Dave Johnson
criticalSticky Key Like Backdoor ExecutionFlorian Roth (Nextron Systems), @twjackomo, Jonhnathan Ribeiro, oscd.community
highPotential APT10 Cloud Hopper ActivityFlorian Roth (Nextron Systems)
highPotential CVE-2023-21554 QueueJumper ExploitationNasreddine Bencherchali (Nextron Systems)
highCVE-2023-38331 Exploitation Attempt - Suspicious WinRAR Child ProcessNasreddine Bencherchali (Nextron Systems), Andreas Braathen (mnemonic.io)
highPotential Suspicious Child Process Of 3CXDesktopAppNasreddine Bencherchali (Nextron Systems)
highPaperCut MF/NG Potential ExploitationNasreddine Bencherchali (Nextron Systems), Huntress DE&TH Team (idea)
highPotential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309)Nisarg Suthar
highWindows Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali
highSuspicious ArcSOC.exe Child ProcessMicah Babinski
highSuspicious BitLocker Access Agent Update Utility Executionandrewdanis, Swachchhanda Shrawan Poudel (Nextron Systems)
highSuspicious Child Process Of BgInfo.EXENasreddine Bencherchali (Nextron Systems)
highPotentially Suspicious Child Processes Spawned by ConHostSwachchhanda Shrawan Poudel (Nextron Systems)
highSuspicious Child Process of Notepad++ Updater - GUP.ExeSwachchhanda Shrawan Poudel (Nextron Systems)
highHTML Help HH.EXE Suspicious Child ProcessMaxim Pavlunin, Nasreddine Bencherchali (Nextron Systems)
highSuspicious Shells Spawn by Java Utility KeytoolAndreas Hunkeler (@Karneades)
highSuspicious Child Process Of Manage Engine ServiceDeskFlorian Roth (Nextron Systems)
highSuspicious Processes Spawned by Java.EXEAndreas Hunkeler (@Karneades), Florian Roth
highMMC Spawning Windows ShellKarneades, Swisscom CSIRT
highSuspicious MSHTA Child ProcessMichael Haag
highOneNote.EXE Execution of Malicious Embedded Scripts@kostastsale
highSuspicious Microsoft OneNote Child ProcessTim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Elastic (idea)
highSuspicious Outlook Child ProcessMichael Haag, Florian Roth (Nextron Systems), Markus Neis, Elastic, FPT.EagleEye Team
highSuspicious Microsoft Office Child ProcessFlorian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io
highSuspicious Provlaunch.EXE Child ProcessNasreddine Bencherchali (Nextron Systems)
highPotentially Suspicious Child Process Of Regsvr32elhoim, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
highPotential Defense Evasion Via Rename Of Highly Relevant BinariesMatthew Green - @mgreen27, Florian Roth (Nextron Systems), frack113
highSuspicious ShellExec_RunDLL Call Via OrdinalSwachchhanda Shrawan Poudel

And 33 more rules that name cscript.exe.

T1059.005Command and Scripting Interpreter: Visual Basic
T1059.007Command and Scripting Interpreter: JavaScript
T1220XSL Script Processing
T1564.004Hide Artifacts: NTFS File Attributes

Is it the real cscript.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Script Host, Microsoft Corporation
DescriptionMicrosoft Console Based Script Host

14 known copies

5.812.10240.16384 · C:\WINDOWS\SysWOW64\cscript.exe · signed by Microsoft Windows

4645529996afe20c5c53e5050968ec035cce4db1755f95878d41db6781641fd7

5.812.10240.16384 · C:\WINDOWS\system32\cscript.exe · signed by Microsoft Windows

4f059ac07f90e95bdaf0d7f0d1c54ddcdc0651a1e0d8aa5f03d11d6b0521177f

5.812.10240.16384 · C:\Windows\system32\cscript.exe · signed by Microsoft Windows

59d3cdc7d51fa34c6b27b8b04ea17992955466eb25022b7bd64880ab35df0bbc

5.812.10240.16384 · C:\Windows\system32\cscript.exe · signed by Microsoft Windows

6216383428eab3292c5590c70d24b33a7d84fbf1c463e331c40f052e6ea356fe

5.812.10240.16384 · C:\Windows\SysWOW64\cscript.exe · signed by Microsoft Windows

873a28c3a6d1d6278b4fa422f65fadf18150301d31b9afa694bdb5e3bd6a165d

5.812.10240.16384 · C:\Windows\SysWOW64\cscript.exe · signed by Microsoft Windows

a80e2d4b10e53c5f1d1bb41fd117fc5b6c358b87e3b2c197fc9af484bc44e5c6

5.812.10240.16384 · C:\Windows\system32\cscript.exe · signed by Microsoft Windows

ae37fd1b642e797b36b9ffcec8a6e986732d011681061800c6b74426c28a9d03

5.812.10240.16384 · C:\Windows\SysWOW64\cscript.exe · signed by Microsoft Windows

b6c61c065f8bca4a5b8f560c12379859bdcaa0844245a3a31025614c086ff89a

5.812.10240.16384 · C:\Windows\SysWOW64\cscript.exe · signed by Microsoft Windows

bbd44ac1c7dfd0102eba486aa1552742a11c4a94283133ed0c4aac92fad6a4d9

5.812.10240.16384 · C:\WINDOWS\system32\cscript.exe · signed by Microsoft Windows

c4277bdca39e0a1fbc61137e90cca9eaae0a1768eac344efc03c73e8fc5305b5

5.812.10240.16384 · C:\Windows\system32\cscript.exe · signed by Microsoft Windows

c69648b049e35ff96523c911737a0481d52dd06508a561094a4fa895a30a6535

5.812.10240.16384 · C:\WINDOWS\SysWOW64\cscript.exe · signed by Microsoft Windows

d8c325e993b6bb5b2817d4a1f6d684eee00da95d613f8df74ad28ffbc8cb6b3d

5.8.9600.16384 · C:\windows\system32\cscript.exe · not signed

3e0b04ab2c927dcbb0bb64aa99b3060481fa7876ac4c12863d649e8beadc8814

5.8.9600.16384 · C:\windows\SysWOW64\cscript.exe · not signed

7824c45fc033696603fe97d8f193a1872dfb2b5db75f0cda21df27017b3cb623

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

Everyday use

from tldr-pages, CC BY 4.0

Set cscript (CLI) or wscript (GUI) as the default interpreter to run Windows Script Host programs

cscript //h:cscriptIdentify

Run a script

cscript path\to\script.vbsIdentify

Trips 1 Sigma rule: mediumWSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript by Michael Haag

Run script in the interactive or batch mode (enable or suppress alerts, prompts, and scripting errors)

cscript //i path\to\script.vbsIdentify

Trips 1 Sigma rule: mediumWSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript by Michael Haag

Of the 3 examples the identifier reads, 2 match LOLBAS abuse or trip a Sigma process-creation rule.

Options

13 in Windows commands reference
Show every option of cscript.exe
/bSpecifies batch mode, which does not display alerts, scripting errors, or input prompts.
/dStarts the debugger.
/eSpecifies the engine that is used to run the script.
/hRegisters cscript.exe as the default script host for running scripts.
/iSpecifies interactive mode, which displays alerts, scripting errors, and input prompts.
/jobRuns the job identified by *identifier* in a .wsf script file.
/logoSpecifies that the Windows Script Host banner is displayed in the console before the script runs.
/nologoSpecifies that the Windows Script Host banner is not displayed before the script runs.
/sSaves the current command-prompt options for the current user.
/tSpecifies the maximum time the script can run (in seconds).
/uSpecifies Unicode for input and output that is redirected from the console.
/xStarts the script in the debugger.
/?Displays available command parameters and provides help for using them.

Other programs abused for ADS

bitsadmin.exe · certutil.exe · cmd.exe · control.exe · diantz.exe · esentutl.exe · expand.exe · extrac32.exe · findstr.exe · forfiles.exe · makecab.exe · mavinject.exe · mpcmdrun.exe · mshta.exe · msxsl.exe · print.exe