SHADOW#REACTOR Process Chain Detection

nomit vyas@xoxo

•updated Jun 23, 2026•0•0•4

Detects the specific process chain: wscript.exe -> powershell.exe -> MSBuild.exe, which is characteristic of the SHADOW#REACTOR malware campaign. This chain indicates the use of scripting interpreters (Wscript, PowerShell) to launch the Microsoft Build Engine (MSBuild) for potentially malicious code execution.