VBScript Dropped to Startup Folder

Brandon Rodriguez@BMRodriguez

•updated May 22, 2026•4•0•104

Detects the creation of .vbs or .vbe files in the Windows Startup folder. This technique is actively used by Gamaredon (leveraging CVE-2025-8088) to drop the GammaDrop payload for persistence.