Kimsuky JSE Loader XML DOM: PowerShell Spawned from wscript/cscript with Hidden Encoded Execution

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects the execution of PowerShell via wscript.exe or cscript.exe, often indicative of malicious VBScript or JScript files executing obfuscated or hidden payloads. The rule checks for specific PowerShell arguments (e.g., -windowstyle hidden, -noni, -decode) or references to the ProgramData directory in the command line.