JavaScript is mainly a web language that powers billions of pages on the internet, so it is no surprise that it is commonly used to create exploits targeting web users. However, on Windows, it is also possible to execute JScript (a very similar dialect of ECMAScript) files through Windows Script Host, which also makes it a good candidate for malicious attachments and post-compromised scripting.
A relatively recent fileless Poweliks threat used JScript stored in the registry in order to achieve system persistence. Since there are minor differences between JavaScript and JScript, here, we will cover syntax that is common to both of them. Additionally, starting from this moment, we will use the JS notation.
The universal file extension for JS files is .js; encoded JScript files have the .jse extension. Additionally, they can be embedded into .wsf and .hta files in the same way as VBScript. In terms of similarity, on Windows, both .js/.jse and .wsf files can be executed...
