Suspicious WScript Extracting Archive via Tar
Detects wscript.exe or cscript.exe spawning cmd.exe to decompress a specific archive using the built-in Windows tar utility. This staging behavior is used by the PyLangGhost VBScript loader to unpack required library files before executing the RAT payload associated with NICKEL ALLEY campaigns.
Sigma
