Hidden VBS Execution for Audio Settings Spoofing (AsyncRAT)

Ibrahim Saud@tektrix

•updated Jun 18, 2026•3•1•15

This rule detects the execution of a VBScript file named 'ResetRealtekAudioSettings64.vbs' by 'wscript.exe'. This specific activity has been associated with AsyncRAT, where it's used to continue the execution chain, potentially to spoof audio settings or for other malicious purposes.