VBS dropper (script.vbs) kills powershell.exe via taskkill before relaunch

Duo Tech@duotech

•updated Jul 2, 2026•1•0•1

Detects instances where wscript.exe or cscript.exe executing a VBScript file subsequently spawns taskkill.exe with arguments intended to terminate PowerShell processes. This is a common pattern used by malicious scripts to disrupt security monitoring or automated management tasks.