SHADOW#REACTOR Process Chain Detection

Ethan Andrews@eandrews

•updated Jan 15, 2026•4•1•27

Detects a suspicious process chain involving wscript.exe spawning powershell.exe, which then spawns MSBuild.exe. This specific chain is characteristic of the SHADOW#REACTOR malware campaign, indicating potential execution of malicious code via trusted utilities.