LausivLoader wscript/cscript spawning PowerShell via env vars

Ibrahim Saud@tektrix

•updated Sep 20, 2026•1•0•3

Detects the execution of PowerShell via WScript or CScript where the command line contains instructions to remove an environment variable. This pattern is commonly used by adversaries to clear sensitive environment data or bypass certain application restrictions.