Kimsuky WScript.exe Registry Enumeration of File Association Keys

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects anomalous registry activity by wscript.exe, specifically targeting keys associated with file association, COM object registration, or run-time startup locations. A high count of registry open operations by a scripting engine often indicates persistence installation or reconnaissance of system configuration.