VBScript Execution with Known Malware Indicators
Detects the execution of VBScript (wscript.exe or cscript.exe) where the command line contains strings indicative of known malware families such as Xworm, Remcos, DarkCloud, Phantom, Masslogger, or Agent Tesla. This rule aims to identify potential phishing attempts or initial access vectors leveraging VBScript for malware delivery.
Microsoft Sentinel (KQL)
