Windows Attack Surface Management: Script-based Malware

This report examines the rising abuse of Windows scripting languages—PowerShell, JScript, and VBScript—by cybercriminals, explains why script-based attacks are effective (ubiquity, stealth, in-memory execution, access to .NET), cites observed usage and actor reliance (e.g., FIN7), and provides actionable mitigations and detection guidance such as Constrained Language Mode, restrictive execution policies, Windows Defender Exploit Guard, EDR, and monitoring rules.