Kimsuky NUKESPED ADODB.Stream Binary Drop and WScript Execution Chain
Detects the creation of files by WScript.exe or CScript.exe in temporary or program directories followed by the subsequent execution of those files by the same scripting host within a 120-second window. The rule specifically looks for evidence of script-based decoding or processing (e.g., via certutil or hidden windows), which is often associated with the multi-stage execution of payloads.
Splunk (SPL)
