what is cscript.exe and how this related to malware and MITRE ATT@CK

Its windows scripting host which runs script files. windows runs this to execute scripts. sometimes malware and attacker may utilize this. sysinternals tool autoruns can tell you what scripts are running. or check windows task scheduler from computer management section. 

you can try with free version of malware bytes to check your systems whether malware is calling cscript or not. 

example:

image: C:\Windows\system32\cscript.exe

cmdline: CSCRIPT.EXE //NOLOGO M.VBS

attacker may abuse visual basic for execution. VB is a programming language created by Microsoft. 

Derivative languages based on VB have also been created, such as visual basic for application (VBA) and VBScript. VBA is an event-driven programming language built into microsoft office as well as several third party application like wikipedia. 

VBA enables documents to contain macros which is used to automate the execution of tasks and other functionality on the host. VBScript is default scripting language on windows hosts and can also be used in place of JavaScript on html application. Though most modern browser do not come with VBScript support.

Adversaries may use VB payloads to execute malicious commands. Common malicious usage includes automating execution of behaviors with VBScript or embedding VBA content into Spearphishing Attachment payloads.

 

Avi