NUKESPED Registry Enumeration via WScript for File Association Hijack and Persistence

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects high-frequency registry modification activity by Windows script hosts (wscript.exe or cscript.exe) targeting common persistence locations such as Run keys and file association command keys. This behavior is indicative of malicious scripts attempting to establish persistence or hijack system execution flows.