Malicious Scripting

Adversaries may abuse JavaScript implementations to execute code through Windows Script Host (JScript via wscript.exe or cscript.exe), an HTML Application containing JavaScript via mshta.exe, or JavaScript for Automation (JXA) via osascript on macOS. These are alternative interpreter routes for an already available script or HTA. The commands here invoke that content; they do not themselves create or retrieve it, and any later reconnaissance, payload staging, network activity, or system change depends on the script's contents.