LabubaRAT wscript.exe execution of dropped wupd_ prefixed JScript file
Detects the execution of JScript files via wscript.exe where the file name follows the 'wupd_' naming convention. This pattern is characteristic of LabubaRAT, which drops obfuscated or malicious scripts with this prefix to execute them using the Windows Script Host.
Microsoft Sentinel (KQL)
