Kimsuky NUKESPED JSE Loader Anti-Analysis: Debugger Check via WMI

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the execution of WMI queries or hidden PowerShell commands initiated by JScript/VBScript interpreters (wscript.exe/cscript.exe), a behavior characteristic of Kimsuky's NUKESPED loader for performing anti-analysis and sandbox evasion.