LabubaRAT JavaScript Task Execution via wscript.exe

Kaung Khant Ko@kaungkhantko

•updated Jul 15, 2026•1•0•1

This rule detects the execution of LabubaRAT JavaScript files using the Windows Script Host (wscript.exe). It monitors for the specific combination of process execution flags that enforce JScript interpretation and filters for filenames containing 'wupd_' with a .js extension, which are indicators associated with this malware's deployment behavior.