Kimsuky CHM chain: wscript.exe spawns encoded/hidden PowerShell to dynv6 C2

Ibrahim Saud@tektrix

•updated Jul 2, 2026•0•0•1

This rule detects the execution of PowerShell via a WScript process (wscript.exe) as the parent, combined with suspicious command-line flags such as hidden window style, encoded commands, or references to the dynv6.net domain often used by attackers for C2 infrastructure.