Kimsuky NUKESPED JSE Loader Anti-Analysis Sleep Evasion

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects activities associated with the Kimsuky NUKESPED malware loader, including the execution of malicious .jse scripts, PowerShell-based obfuscated payload decoding using 'ProgramData' as a staging path, and the subsequent execution of the 'zlrenu8.exe' payload. The rule specifically targets the multi-stage infection chain where scripts are used to perform anti-analysis and sandbox evasion before launching the primary malicious component.