Potential Dropper Script Execution Via WScript/CScript/MSHTA — Detection Rule

Detects wscript/cscript/mshta executions of scripts located in user directories

Read the full analysis on IntelFusions