[jmau111]

While it's true, such scripts usually install crap using the victim's privileges behind the scene.

[_8j50]

Which scripts? Malicious scripts...yeah. But you can stop using wscript,mshta,bat,etc... and only allow powershell signed scripts with JEA restriction.

[jmau111]

indeed, but the point was this malicious scripts usually try to install programs, like droppers.

[_8j50]

Running and installing are different things. A popular dropper I frequently run into for example never drops an executable to disk, it loads base64 from registry, decodes/decrypts it and reflectively executes the .NET assembly which in turn decodes and executes shell code from registry.