Kimsuky JSE Loader Scripting.FileSystemObject Use for Payload Staging

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects malicious .jse loader scripts associated with Kimsuky's NUKESPED malware family. The rule identifies suspicious behaviors including the creation of Scripting.FileSystemObject for filesystem manipulation, use of GetSpecialFolder for staging, and file system enumeration via GetFile, which are key components of the threat's payload delivery and staging process.