← All detection heuristics · HTML
high
HTML_WINDOWS_SCRIPTING_OBJECT
What it means
HTML references COM objects commonly used for execution or payload download.
Why it fires
Objects such as WScript.Shell, Shell.Application, MSXML2.XMLHTTP, and ADODB.Stream provide command execution and staged-download capability from script.
Other HTML heuristics
HTML_HTA_VBSCRIPT_DOM_EXECUTE HTML_THIRD_PARTY_CREDENTIAL_HARVEST HTML_ACTIVEX_OBJECT HTML_VBSCRIPT HTML_CREDENTIAL_PHISH_DYNDNS HTML_SCRIPTED_COM_EXECUTION HTML_SMUGGLED_PAYLOAD HTML_XOR_BASE64_EVAL_INJECTION HTML_LONG_BASE64_SCRIPT_PAYLOAD HTML_OBFUSCATED_STRING_BUILDER HTML_AD_FRAUD_CLOAKING HTML_BASE64_PAYLOAD_URL