~/ cat Cscript.exe.md █
Binary used to execute scripts in Windows
Paths:
C:\Windows\System32\cscript.exe
C:\Windows\SysWOW64\cscript.exe
Detection: Cscript.exe executing files from alternate data streams
Alternate data streams
Use cscript.exe to exectute a Visual Basic script stored in an Alternate Data Stream (ADS).
cscript c:\ads\file.txt:script.vbs