This query returns events where a script interpreter (cscript.exe, wscript.exe or mshta.exe) was executed from a Web browser process. The logic here is similar from the one from Day 11 query, however, ...

The following table contains possible examples of cscript.exe being misused. While cscript.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.