VBS Stager Execution Correlated with ftp.exe -s: or Signed Binary Launch for TriBack Loader
Detects the JadeProx VBS stagers (script.vbs, pdf.vbs, Claude.vbs) launched via wscript.exe only when followed by the known suspicious child-process behavior - either the ftp.exe -s:script.dat alternate trigger, or the wscript.exe-spawned launch of the signed ServiceHub.DataWarehouseHost.exe binary used to sideload TriBack Loader. Matching on the VBS filename alone is too broad since wscript.exe executing .vbs scripts is common for legitimate admin/logon scripting; requiring the parent-child correlation to the follow-on suspicious action narrows the detection to the actual attack chain.
Sigma
