Binary used to execute scripts in Windows

Paths:

C:\Windows\System32\cscript.exe
C:\Windows\SysWOW64\cscript.exe

Detection: Cscript.exe executing files from alternate data streams

Alternate data streams

Use cscript.exe to exectute a Visual Basic script stored in an Alternate Data Stream (ADS).

cscript c:\ads\file.txt:script.vbs