Cscript.exe

Binary used to execute scripts in Windows

ADS

Can be used to evade defensive countermeasures or to hide as a persistence mechanism

cscript //e:vbscript {PATH_ABSOLUTE}:script.vbs

Use cscript.exe to exectute a Visual Basic script stored in an Alternate Data Stream (ADS). — MITRE: T1564.004 — Privileges: User