Kimsuky NUKESPED JSE Loader - WMI Sandbox Evasion via Long-Lived Script Host

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects long-running WScript or CScript processes executing script files (ending in .js or .jse) that perform environment enumeration via WMI queries (e.g., Win32_ComputerSystem, Win32_BIOS, Win32_VideoController). This behavior is often indicative of automated sandbox evasion and reconnaissance performed by malicious scripts or droppers.