Storm-2561 - Batch Script Disguised Execution (T1036.008)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•3

Detects the execution of .bat or .cmd scripts disguised as VPN installer components utilizing curl or wget to pull down malware.