WScript.Shell JScript Dropper Spawning Hidden PowerShell from C:\Temp

Duo Tech@duotech

•updated Jun 30, 2026•0•0•1

Detects the execution of wscript.exe spawning a child powershell.exe process with arguments specifically configured to execute a script file starting with 'ps_' from the 'C:\Temp' directory. This behavior is highly characteristic of JScript droppers commonly associated with malicious email attachments that write and launch secondary payloads silently in the background.