Temp-Directory Dropper Script Launched by Powershell/Script Interpreter

Georg Lauenstein@gsec

•updated Jan 15, 2026•5•1•199

Detects the execution of scripts (.ps1, .vbs, .php) with randomized or suspicious names from the Temp directory, where the parent process is explorer.exe, wscript.exe, or cscript.exe. This behavior is indicative of a dropper staging and executing its payload.