ChainScript scatter.ps1 redistributing files to decoy MS paths

Ibrahim Saud@tektrix

•updated Sep 21, 2026•0•0•5

This rule detects the creation, modification, or renaming of files within specific sensitive directories under Local AppData (such as ComponentTask33, INetCache/FilterManager, or Shell/RemoteTempPrimary) that are closely timed with the execution of a PowerShell script named '*_scatter.ps1'. This behavior is indicative of potential malicious staging, data dropping, or modular deployment associated with a specific script-based attack chain.