A VBS file is a Visual Basic Script file used by Windows scripting support. It can run commands, launch programs, read or write files, and chain into other tools without needing a separate compiled executable. Because it is a native Windows format, it often looks like ordinary administration or automation activity.
In cyber attacks, VBS files are commonly used as launchers or droppers. An attacker may attach a script to email, hide it in an archive, or use it to start PowerShell, download a payload, or execute a second-stage implant. This matters because script-based launchers can bypass user suspicion and sometimes slip past simple file-based controls. Defenders look for suspicious script execution, unusual parent-child process chains, encoded content, and VBS files that start network activity or invoke system tools outside normal workflow.