IDE Spawning WScript Hidden Execution
Detects VS Code or Cursor launching wscript.exe with specific command-line arguments indicating hidden execution of VBScript payloads. This behavior is associated with the UNK_DeadDrop campaign.
Microsoft Sentinel (KQL)
