Kimsuky NUKESPED JSE Loader Registry Profiling via WScript.exe
Detects WScript.exe performing multiple registry queries against sensitive Windows Classes and file association keys. This pattern of behavioral profiling is consistent with Kimsuky's NUKESPED downloader or JSE loader identifying system configuration before payload execution.
Microsoft Sentinel (KQL)
