LausivLoader: PowerShell Env-Var File Path Handoff from WScript/CScript

Ibrahim Saud@tektrix

•updated Sep 20, 2026•0•0•3

Detects execution of PowerShell spawned by wscript.exe or cscript.exe attempting to retrieve a process-level environment variable named 'Kv[0-9]+'. This pattern is associated with 'LausivLoader', which uses environment variables to pass file paths or malicious payloads between a legacy script host and PowerShell. The rule optionally tracks attempts to delete associated files after the handoff.