cscript

Windows CMD execution T1059.005

Windows Script Host console runner for JScript and VBScript. Executes script files from disk or UNC paths.

Binary Paths

  • C:\Windows\System32\cscript.exe
  • C:\Windows\SysWOW64\cscript.exe

Glob Patterns

Pattern Notes
for /f %i in ('where cs?ript.exe') do %i script.vbs
Single char wildcard replaces 'c' — cs?ript matches cscript
for /f %i in ('where c*ript.exe') do %i script.vbs
Star matches 's' after 'c' and before 'ript'
for /f %i in ('where csc*.exe') do %i script.vbs
Star suffix matches 'ript.exe'
for /f %i in ('dir /b C:\Windows\System32\csc*.exe') do %i script.vbs
dir /b glob finds cscript.exe in System32
forfiles /p C:\Windows\System32 /m cs?ript.exe /c "@file script.vbs"
forfiles ? wildcard in mask finds cscript.exe — @file expands to matched filename
C:\Windows\System32\CSCRIP~1.EXE script.vbs
8.3 SFN — CSCRIP~1 auto-generated for cscript.exe; requires NtfsDisable8dot3NameCreation=0
for %i in (C:\Windows\System32\csc*.exe) do @%i script.vbs
Native CMD for loop with filesystem glob — expands csc*.exe directly in System32 without where.exe
for /f %i in ('where /r C:\Windows csc*.exe') do %i script.vbs
Recursive where search across Windows tree — finds cscript.exe in System32 and SysWOW64
cmd /v:on /c "set x=cscript& !x! script.vbs"
Delayed variable expansion — /v:on enables !var! syntax; !x! resolves at runtime only, invisible to parse-time static analysis

Pattern Tester

$

Try typing cscript or a full path like C:\Windows\System32\cscript.exe

YARA Rule

Auto-generated detection rule for cscript

      

Platform Notes

cscript.exe runs scripts with console output. wscript.exe is the GUI counterpart. Both are commonly flagged; glob obfuscation on the binary name via where or forfiles bypasses some string-based detections.

Resources

← Previous cmd Catalog Next → curl