Operation Poisson: VBScript Stager Spawning PowerShell for Havoc Demon In-Memory Load
Detects a multi-stage in-memory delivery chain associated with Operation Poisson, where wscript.exe spawns powershell.exe to load and execute the Havoc Demon agent in memory via a VBScript stager.
YARA-L
