PeckBirdy LOLBin API Pattern Execution

Kaung Khant Ko@kaungkhantko

•updated Jan 30, 2026•15•0•123

Detects the execution of mshta.exe or wscript.exe with a command line pattern matching the PeckBirdy C2 framework's API for fetching landing scripts. The pattern consists of a 32-character ID followed by '/hta', '/wscript', or '/html'.