Windows Scripting Host (WSH) is a built-in Windows component that executes script files such as VBScript and JScript. It gives scripts access to system functions, files, and other automation features, which makes it useful for legitimate administration but also attractive to attackers.
In cyber security, WSH matters because malware can abuse it as a trusted execution path. A malicious script may run when a user opens an attachment, double-clicks a file, or a system is configured to allow script execution without restrictions. Defenders reduce this risk by limiting script hosts, applying attachment controls, using application allowlisting, and monitoring for suspicious script execution or unusual email-driven activity. If WSH is exposed unnecessarily, it can turn a simple script into a fast and effective malware launcher.