Suspicious WScript Execution from Data Folder

Duo Tech@duotech

•updated Jun 3, 2026•1•0•16

Detects the execution of wscript.exe loading a VBScript from a relative suspicious subdirectory like ".\data\", indicative of the initial LNK-based infection chain observed in Operation Dragon Weave.