Millenium RAT PowerShell/VBScript Dropper via LNK Lure (mcdir.me)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects a multi-stage execution chain involving PowerShell and VBScript, commonly associated with initial access or staging phases of an attack. The rule identifies PowerShell execution with hidden windows, potential malicious downloads from specific domains, script execution via WScript/CScript, and the subsequent execution of dropped files such as 'doc1.exe' from temporary directories.