winPatch.zip / update.vbs Dropped in TEMP by PowerShell or wscript

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•0

Detects the creation of files with names containing 'winPatch' and extensions of '.zip' or '.vbs' in Windows TEMP directories, originating from PowerShell or WScript processes. This behavior is indicative of potential ingress tool transfer or staging of malicious scripts.