Some of the most effective tools in an attacker's arsenal aren't malware at all: they're the trusted, signed scripting engines built into applications and systems. Abusing them lets an adversary gain initial access and execute code while blending into normal activity, with little or nothing written to disk for signature-based defences to catch.

This room examines script-based execution across four technologies leveraged by attackers: VBA macros, VBScript, JScript, and HTA, from both the legitimate and adversary perspectives. You'll follow a realistic intrusion end to end, from a phishing document through proxy execution to persistence. Then you'll investigate it as a DFIR analyst, detecting the activity in Windows Event Logs and Sysmon, and reconstructing it from the artifacts it leaves behind, even when the payload never touches disk.

Learning Objectives

After completing this room, you will be able to:

• Recognise how VBA, VBS, JScript, and HTA are abused for initial access and execution, and why their legitimacy defeats signature-based detection
• Detect script-based execution using Windows Event Logs and Sysmon, and understand the limits of log-only detection
• Reconstruct an intrusion from DFIR artifacts, including recovering and analysing a malicious macro, even in a fileless scenario

Prerequisites

Before starting this room, you should be familiar with:

• Basic Windows internals (Windows Internals)
• Windows Event Logs (Windows Logging for SOC)
• Fundamental incident response concepts (Incident Response Fundamentals)