Kimsuky NUKESPED: WScript/CScript Spawning PowerShell with certutil -decode to ProgramData

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects the execution of PowerShell or pwsh processes launched by wscript or cscript, using hidden window flags and certutil -decode arguments, specifically targeting scripts located in the ProgramData directory. This pattern is frequently observed in malicious file stagers and payload deobfuscation.