Script detection heuristics

Obfuscated WSH script critical SCRIPT_WSH_OBFUSCATED

Windows Script Host content includes execution or obfuscation indicators.

PowerShell Add-Type WinAPI tamper/injection scaffold critical WINDOWS_PS_ADDTYPE_WINAPI_TAMPER

PowerShell embeds C# P/Invoke code for suspicious WinAPI process/window/shell operations.

PowerShell bigint-obfuscated network endpoint critical LNK_POWERSHELL_BIGINT_NETWORK_ENDPOINT

A shortcut reconstructs a downloader endpoint from large integer arithmetic.

PowerShell captures and uploads desktop screenshots critical WINDOWS_PS_SCREENSHOT_UPLOAD_EXFIL

PowerShell captures the desktop and uploads saved screenshots with WebClient.

Script decodes a DLL and executes its export critical WINDOWS_SCRIPT_CERTUTIL_RUNDLL_CHAIN

Hidden PowerShell invokes certutil -decode and rundll32 on the result.

WSH stream-write-and-run chain critical SCRIPT_WSH_STREAM_WRITE_RUN_CHAIN

A Windows script creates COM objects, writes a file, and reaches a shell execution sink.

Windows Scheduled Task executes script host critical WINDOWS_SCHEDULED_TASK_SCRIPT_EXEC

Scheduled Task XML launches a script interpreter or LOLBin.

Windows script decodes and writes an embedded binary critical WINDOWS_SCRIPT_BASE64_BINARY_DROPPER

WSH/JScript uses XMLDOM Base64 conversion and ADODB.Stream with a large embedded blob.

Windows shortcut launches a script downloader critical LNK_SCRIPT_DOWNLOADER

Shell Link arguments launch a script host/LOLBin and retrieve a remote payload.

macOS zsh loader critical MACOS_ZSH_LOADER

File bytes contain a base64/gzip shell loader executed with zsh.

Heavy JavaScript string-decoder obfuscation high SCRIPT_HEAVY_STRING_DECODER_OBFUSCATION

A large near-single-line script hides behavior behind rotated string tables and character-code decoding.

Windows Script Host masquerade high SCRIPT_WSH_MASQUERADE

File contains Windows Script Host code while masquerading as a document.

Windows shortcut hides script-interpreter execution high LNK_HIDDEN_SCRIPT_EXEC

LNK launches a script host with hidden or reduced-interaction flags.