← All detection heuristics · HTML
high
HTML_VBSCRIPT
What it means
Standalone HTML contains a VBScript script block.
Why it fires
VBScript in local HTML documents is a legacy Windows execution surface. Malicious attachments commonly use it with COM objects to download, drop, or execute payloads.
Other HTML heuristics
HTML_HTA_VBSCRIPT_DOM_EXECUTE HTML_THIRD_PARTY_CREDENTIAL_HARVEST HTML_ACTIVEX_OBJECT HTML_WINDOWS_SCRIPTING_OBJECT HTML_CREDENTIAL_PHISH_DYNDNS HTML_SCRIPTED_COM_EXECUTION HTML_SMUGGLED_PAYLOAD HTML_XOR_BASE64_EVAL_INJECTION HTML_LONG_BASE64_SCRIPT_PAYLOAD HTML_OBFUSCATED_STRING_BUILDER HTML_AD_FRAUD_CLOAKING HTML_BASE64_PAYLOAD_URL