JavaScript Execution via WScript Spawning PowerShell
Detects the execution of PowerShell by the Windows Script Host (wscript.exe or cscript.exe). This behavior is often associated with malicious JavaScript droppers that download and execute second-stage payloads, as seen in the delivery of malware like NanoCore RAT.
Sigma
