wscript.exe

Windows Script Host's Windows-based host (wscript.exe) runs scripts through registered scripting engines, including VBScript and JScript. It can be abused to execute scripts, including the alternate-data-stream pattern documented by LOLBAS and mapped to ATT&CK T1564.004. Microsoft lists wscript.exe among applications that can bypass App Control allow policies and recommends blocking it when business use does not require it; this behavior depends on the host version and policy configuration.