← All detection heuristics · Script
high
SCRIPT_WSH_MASQUERADE
What it means
File contains Windows Script Host code while masquerading as a document.
Why it fires
WScript/CScript content can execute directly on Windows. When it is submitted with a document-like name or extension, it is a common attachment masquerade pattern.
Other Script heuristics
SCRIPT_WSH_OBFUSCATED WINDOWS_PS_ADDTYPE_WINAPI_TAMPER LNK_POWERSHELL_BIGINT_NETWORK_ENDPOINT WINDOWS_PS_SCREENSHOT_UPLOAD_EXFIL WINDOWS_SCRIPT_CERTUTIL_RUNDLL_CHAIN SCRIPT_WSH_STREAM_WRITE_RUN_CHAIN WINDOWS_SCHEDULED_TASK_SCRIPT_EXEC WINDOWS_SCRIPT_BASE64_BINARY_DROPPER LNK_SCRIPT_DOWNLOADER MACOS_ZSH_LOADER SCRIPT_HEAVY_STRING_DECODER_OBFUSCATION LNK_HIDDEN_SCRIPT_EXEC