WScript Execution from Public Folder
Detects the execution of wscript.exe loading a script file from the C:\Users\Public\ directory, a behavior observed in the DesckVB RAT staging process. This technique is often used by adversaries to execute malicious scripts from a commonly accessible location.
Microsoft Sentinel (KQL)
