GammaSteel Fallback C2 VBScript Execution

Duo Tech@duotech

•updated Jun 4, 2026•2•0•6

Detects the execution of arbitrary VBScript code dropped into the user's temporary directory by the GammaSteel C2 fallback mechanism. The payload is typically written to a temporary file and executed using wscript.exe with specific flags (//e:vbscript and //b).