Kimsuky NUKESPED: Archive Lure → WScript JSE Multi-Hop Process Lineage

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the execution of script files (e.g., .js, .jse, .vbs) via Windows Script Host (wscript.exe, cscript.exe) where the parent or grandparent process is a known archive extraction utility (e.g., 7zip, WinRAR). The rule further filters by identifying keywords associated with malicious lures (e.g., 'health', 'medical', 'nhis'). This behavior is commonly associated with phishing campaigns delivering malicious attachments.