Kimsuky JSE Loader Writing PE to %TEMP% via FileSystemObject and Silent Execution
Detects behavior indicative of the Kimsuky threat group's JSE loaders. The rule identifies two distinct phases: the use of 'Scripting.FileSystemObject' to write a PE executable to a temporary directory, and the subsequent silent execution of that file using 'WScript.Shell.Run' with a hidden window style. This is a common pattern for dropper activity originating from malicious JScript files.
Microsoft Sentinel (KQL)
