Suspicious Script Spawning Executable in AppData
Detects the execution of an executable file from the AppData\Local directory by the Windows Script Host (wscript.exe or cscript.exe). This behavior is unusual and was observed in the CHAMELEON#NET campaign where JavaScript droppers were used to launch subsequent stages.
Sigma
