VBScript Sandbox Evasion via Co-occurring RAM Check and Analysis Tool Enumeration
Detects cscript.exe/wscript.exe execution where the command line contains both low-RAM sandbox detection indicators and analysis-tool/process enumeration indicators, consistent with VBScript-based sandbox evasion logic observed in the SMOKE#SCREEN campaign.
Cortex XDR
