Vidar - WScript Anti-Analysis Gate (T1497.001)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•8

Correlates WScript execution terminating early if analysis environments are detected, before transitioning to PowerShell. This rule identifies a pattern where 'wscript.exe' executes and is quickly followed by 'powershell.exe' within a two-minute window, suggesting a potential anti-analysis technique used by malware like Vidar to evade detection in sandboxed environments.