SocGholish - WScript Executing Profile Temp JS (T1059.007)
Detects wscript.exe running JavaScript payloads dropped specifically into the AppData\Local\Temp path, typical of SocGholish fake update execution.
Microsoft Sentinel (KQL)
Detects wscript.exe running JavaScript payloads dropped specifically into the AppData\Local\Temp path, typical of SocGholish fake update execution.
Already have an account?