WScript Execution From ADS
Detects wscript.exe or cscript.exe executing a script from an Alternate Data Stream (ADS) path, specifically within the Users directory, as indicated by a colon without a preceding drive letter context. This behavior is known to be used by malware like GammaWorm for persistence by executing hidden VBScript payloads.
Cortex XDR
