LokiBot JScript Loader — WSH Spawning PowerShell or CMD

Duo Tech@duotech

•updated Jun 30, 2026•0•0•1

Detects instances where Windows Script Host (wscript.exe or cscript.exe) spawns PowerShell or CMD. This pattern is commonly observed in malicious document loaders or script-based droppers, such as those associated with the LokiBot malware, which use JScript files to initiate secondary payload execution.