Windows Script Host is a built-in Windows component that runs script files such as VBScript and JScript directly in the operating system. It provides a legitimate way to automate tasks, but that same convenience makes it attractive to attackers because script execution can look like normal administration rather than a standalone malware program.
In real intrusions, WSH is often used as the first stage of a chain: a script launches additional tools, downloads payloads, or starts PowerShell for further automation. Defenders care about WSH because it can run from user-writable locations and blend into routine activity, making detection harder. Useful signals include WScript.exe or CScript.exe starting from unusual folders, scripts that spawn shells, and repeated access to document directories or other sensitive data sources.