Gootloader Persistence via 8.3 Short Filename
Detects the execution of a JavaScript file via wscript.exe or cscript.exe where the file path in the command line contains a tilde (~). This is indicative of the Gootloader malware, which leverages Windows 8.3 short filenames (e.g., "ADAPTI~1.JS" for "Adaptive Algorithms.js") as part of its persistence mechanism to evade simple string-based detections. The persistence scripts are typically dropped in subfolders under the user's AppData\Roaming directory.
Microsoft Sentinel (KQL)
