Interpreter execution is the running of code through a language runtime, such as Python, PowerShell, or JavaScript, instead of launching a compiled standalone binary. The interpreter reads the script at runtime and executes it directly, which can make development faster and attacks more flexible.
In cyber security, this matters because malware that relies on interpreter execution can be easier to modify, reuse, and hide among normal admin activity. Attackers may drop a script, load it with a trusted runtime, and then use it for discovery, persistence, or staging follow-on tools. Defenders watch for unusual script launches, odd command-line arguments, child-process chains, and scripting engines starting from nonstandard parents. Interpreter execution is not malicious by itself, but in a Windows environment it can be a strong clue that a threat actor is using script-based tooling rather than a conventional executable.