Kimsuky VBScript Win32_Process WMI enumeration with report marker

Ibrahim Saud@tektrix

•updated Jul 2, 2026•0•0•1

Detects host profiling activities performed by Kimsuky malware loaders, specifically the use of WMI queries for process enumeration or the execution of 'tasklist' commands. The rule identifies markers often found in the output of these enumeration scripts to identify potential pre-payload reconnaissance.