Millenium RAT PowerShell Dropper via wscript/mshta with Known Payload IOCs

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects execution of PowerShell processes spawned by script hosts (wscript.exe, mshta.exe) with common bypass/encoded flags. The rule identifies suspicious command-line patterns involving known malicious infrastructure domains or specific suspected payload filenames, indicative of the Millenium RAT dropper activity.