wscript

Windows CMD execution T1059.005

Windows Script Host GUI runner for JScript and VBScript. Executes scripts without a visible console window.

Binary Paths

C:\Windows\System32\wscript.exe
C:\Windows\SysWOW64\wscript.exe

Glob Patterns

Pattern	Notes
`for /f %i in ('where ws?ript.exe') do %i script.vbs`	Single char wildcard replaces 'c'
`for /f %i in ('where w*ript.exe') do %i script.vbs`	Star matches 'sc' after 'w'
`for /f %i in ('where wsc*.exe') do %i script.vbs`	Star suffix matches 'ript.exe'
`for /f %i in ('dir /b C:\Windows\System32\wsc*.exe') do %i script.vbs`	dir /b glob finds wscript.exe in System32
`forfiles /p C:\Windows\System32 /m ws?ript.exe /c "@file script.vbs"`	forfiles ? mask finds wscript.exe — @file expands to matched filename
`C:\Windows\System32\WSCRIP~1.EXE script.vbs`	8.3 SFN — WSCRIP~1 auto-generated for wscript.exe; requires NtfsDisable8dot3NameCreation=0
`for %i in (C:\Windows\System32\wsc*.exe) do @%i script.vbs`	Native CMD for loop with filesystem glob — expands wsc*.exe directly in System32 without where.exe
`for /f %i in ('where /r C:\Windows wsc*.exe') do %i script.vbs`	Recursive where search across Windows tree — finds wscript.exe in System32 and SysWOW64
`cmd /v:on /c "set x=wscript& !x! script.vbs"`	Delayed variable expansion — /v:on enables !var! syntax; !x! resolves at runtime only, invisible to parse-time static analysis
`for /f %i in ('where ws?ript.exe') do start "" /b %i script.vbs`	start /b launches wscript.exe as a detached background process — changes parent process attribution in event logs

Pattern Tester

Try typing wscript or a full path like C:\Windows\System32\wscript.exe

YARA Rule

Auto-generated detection rule for wscript

Platform Notes