Visual Basic Script (VBS)-based malicious code exists in various forms such as document type, executable file, and LNK file. After disguising it as a normal file or exploiting a vulnerability to trick the user into executing it, malicious actions are performed when the file is executed. Until recently, malware attacks targeting companies that exploited VBS continued to occur. Therefore, research is needed on effective defense techniques that can detect and respond to VBS malware attacks. Therefore, this survey examined comprehensive information about VBS. Related literature was selected by referring to papers and reports from Google Scholar, Web Science, and security-specialized companies. First, the main characteristics of VBS are explained. Afterward, cases of malicious code attacks targeting Windows systems were presented and analyzed. We also investigated research related to methods for detecting VBS malware. Finally, we describe some defense techniques for detecting malware using VBS. We explain real-time monitoring, blocking, and automation of double-extension file monitoring and deletion based on Python Watchdog. In addition, we analyzed file paths frequently used in VBS attacks and proposed VBS file filtering. In addition, we explained defense methods by detecting VBS malware through event ID and XML-based Windows PowerShell log analysis in Windows Event Viewer and blocking and deleting processes by checking whether network configuration has been changed.