Kimsuky-style PowerShell Download Cradle from wscript/certutil Parent with checkservice.php Callback

Ibrahim Saud@tektrix

•updated Jul 2, 2026•1•0•6

This rule detects the execution of PowerShell via wscript.exe or certutil.exe, followed by the use of suspicious command-line arguments often associated with malicious fileless execution, such as downloading content from the web or executing base64 encoded payloads.