cscript
Windows Script Host console runner for JScript and VBScript. Executes script files from disk or UNC paths.
Binary Paths
C:\Windows\System32\cscript.exeC:\Windows\SysWOW64\cscript.exe
Glob Patterns
| Pattern | Notes |
|---|---|
for /f %i in ('where cs?ript.exe') do %i script.vbs
|
Single char wildcard replaces 'c' — cs?ript matches cscript |
for /f %i in ('where c*ript.exe') do %i script.vbs
|
Star matches 's' after 'c' and before 'ript' |
for /f %i in ('where csc*.exe') do %i script.vbs
|
Star suffix matches 'ript.exe' |
for /f %i in ('dir /b C:\Windows\System32\csc*.exe') do %i script.vbs
|
dir /b glob finds cscript.exe in System32 |
forfiles /p C:\Windows\System32 /m cs?ript.exe /c "@file script.vbs"
|
forfiles ? wildcard in mask finds cscript.exe — @file expands to matched filename |
C:\Windows\System32\CSCRIP~1.EXE script.vbs
|
8.3 SFN — CSCRIP~1 auto-generated for cscript.exe; requires NtfsDisable8dot3NameCreation=0 |
for %i in (C:\Windows\System32\csc*.exe) do @%i script.vbs
|
Native CMD for loop with filesystem glob — expands csc*.exe directly in System32 without where.exe |
for /f %i in ('where /r C:\Windows csc*.exe') do %i script.vbs
|
Recursive where search across Windows tree — finds cscript.exe in System32 and SysWOW64 |
cmd /v:on /c "set x=cscript& !x! script.vbs"
|
Delayed variable expansion — /v:on enables !var! syntax; !x! resolves at runtime only, invisible to parse-time static analysis |
Pattern Tester
$
Try typing cscript or a full path like C:\Windows\System32\cscript.exe
YARA Rule
Auto-generated detection rule for cscript
Platform Notes
cscript.exe runs scripts with console output. wscript.exe is the GUI counterpart. Both are commonly flagged; glob obfuscation on the binary name via where or forfiles bypasses some string-based detections.