Kimsuky NUKESPED JSE Loader Delayed PowerShell Execution via wscript

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the Kimsuky NUKESPED JSE loader anti-analysis pattern. The rule monitors for wscript.exe executing a JSE file, followed by a delayed PowerShell execution containing hidden window flags, decoding or non-interactive flags, and references to ProgramData, which is consistent with sandbox evasion and NUKESPED payload staging.