wscript.exe

by Microsoft

Operating SystemLOLBinhigh risk

Summary

Windows Script Host GUI engine (wscript.exe) executes VBScript (.vbs) and JScript (.js) scripts with a Windows GUI interface. Unlike cscript.exe, it does not display a console window, making it preferred for scripts that run silently.

wscript.exe is the 206th most commonly executed Windows program in EchoTrail's dataset, observed 69,267 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by powershell.exe.

206th

most commonly executed Windows program

69,267

observed executions

medium

statistical confidence

Behavior

Top Paths

C:\Windows\System3299.95%
C:\Windows\SysWOW640.05%

Top Hashes (SHA256)

e479c6e8891cebe2b24f319de83a003d7be73e93bae5aabb5ba3d6b914ff813579.45%
1405f3fd5668c5357e374a918abd21e8d8408b2eda99af9ce593a702da1cc2aa14.37%
fbaa212268aaa7f6b14d411656773117c80112c15a94bf214b064e4415e7003e3.23%
02c731754bcc8f063a8c7aa53c7b7d5773f389e17582ffaa6eaaa692da183fd70.65%
62a95c926c8513c9f3acf65a5b33cbb88174555e2759c1b52dd6629f743a59ed0.64%
34008e2057df8842df210246995385a0441dc1e081d60ad15bd481e062e7f1000.55%
47cacd60d91441137d055184614b1a418c0457992977857a76ca05c75bbc1b560.49%
a3dedca6ae9799c3e32b8a60bb11821f5f96cbc9a465806c4478c5d43754cea10.22%
8b2e206d1f6b510ad73c7541c03f39f9e4ddd7e3d1b9e31f3c8829c64b42e0750.11%
7478b567c9ec9a1e1061f9c6db2993fcdc2ec4e8fb5ca6da80fa307b54116e690.06%

Process Ancestry

Top Grandparents

Top Parents

Top Children

Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.

Security Analysis

What does wscript.exe normally do?

Located in C:\Windows\System32 or C:\Windows\SysWOW64. In this dataset, commonly launched by powershell.exe, svchost.exe (scheduled tasks), and cmd.exe. Used for logon scripts, GPO-deployed scripts, and automation.

When is wscript.exe suspicious?

Spawned by Office applications (winword.exe, excel.exe, outlook.exe) — phishing macro execution. Running scripts from temp, Downloads, or user profile directories. Spawning powershell.exe, cmd.exe, or network tools. Making outbound HTTP/HTTPS connections. Scripts with randomized or obfuscated filenames.

How do attackers abuse wscript.exe?

Phishing initial access: macro-enabled Office documents spawn wscript to execute dropped VBScript payloads. This is one of the most common initial access vectors. Malicious email attachments: .vbs files sent as email attachments execute directly via wscript. Script-based downloaders: VBScript making HTTP requests to download second-stage payloads. Persistence: malicious scripts placed in startup folders or scheduled tasks.

Detection guidance

High-confidence: wscript.exe spawned by Office applications. wscript executing scripts from temp or Downloads directories. wscript making outbound HTTP connections (Sysmon Event ID 3). Medium-confidence: wscript spawning shells or reconnaissance tools. Scripts with randomized names. Profiling parent and grandparent processes is essential given the unpredictable nature of legitimate wscript usage.

False positive notes

PowerShell and scheduled tasks commonly launch wscript for legitimate automation. Logon scripts deployed via GPO use wscript. Some enterprise applications use VBScript for automation. The parent process context is critical for distinguishing legitimate from malicious usage.

MITRE ATT&CK techniques

T1059.005 T1059.007 T1204.002

Related Processes

cmd.exe cscript.exe powershell.exe

Ask Rocky about wscript.exe

Rocky answers questions about wscript.exe grounded in this same dataset — free, no account needed.

Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.

Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.