Xworm V6 Infection Chain Wscript To Powershell

nomit vyas@xoxo

•updated Feb 18, 2026•0•15

Detects XWorm V6 infection chain where wscript.exe spawns powershell.exe executing a .ps1 with Start-Process powershell