Suspicious Romeo or Juliet Scripts Execution

Elgonad .@elgonad

•updated Mar 20, 2026•1•0•45

Detects the execution of PowerShell or VBScript scripts matching the naming conventions "Romeo*.ps1" or "Juliet*.vbs". These scripts are utilized as initial triggers for a stealthy Deno-based in-memory loader, a technique recently observed in LeakNet ransomware campaigns following initial access.