AsyncRAT - WSH Re-Enabling via Registry
Detects the environmental preparation stager modifying registry keys to forcefully re-enable Windows Script Host and restore .vbs file associations.
Microsoft Sentinel (KQL)

Detects the environmental preparation stager modifying registry keys to forcefully re-enable Windows Script Host and restore .vbs file associations.

Already have an account?