WScript Execution From Alternate Data Stream (ADS)

Duo Tech@duotech

•updated Jun 2, 2026•0•0•7

Detects the execution of wscript.exe targeting a script concealed within an Alternate Data Stream (ADS) in the user profile directory. This technique is heavily used by Gamaredon's GammaWorm for persistence and execution.