Potential Dropper Script Execution Via WScript/CScript/MSHTA (cea72823-df4d-4567-950c-0b579eaf0846)

Detects wscript/cscript/mshta executions of scripts located in user directories

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Visual Basic - T1059.005 (dfd7cc1d-e1d8-4394-a198-97c4cab8aa67)	Attack Pattern	Potential Dropper Script Execution Via WScript/CScript/MSHTA (cea72823-df4d-4567-950c-0b579eaf0846)	Sigma-Rules	1
JavaScript - T1059.007 (0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d)	Attack Pattern	Potential Dropper Script Execution Via WScript/CScript/MSHTA (cea72823-df4d-4567-950c-0b579eaf0846)	Sigma-Rules	1
Visual Basic - T1059.005 (dfd7cc1d-e1d8-4394-a198-97c4cab8aa67)	Attack Pattern	Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830)	Attack Pattern	2
JavaScript - T1059.007 (0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d)	Attack Pattern	Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830)	Attack Pattern	2