MSI spawns hidden PowerShell _scatter.ps1 chaining to VBScript-launched node.exe

Ibrahim Saud@tektrix

•updated Sep 22, 2026•1•0•6

This rule detects a sequential multi-stage execution chain starting with msiexec.exe launching a hidden PowerShell script, followed by wscript.exe executing a VBScript agent, and finally node.exe executing a JavaScript file within a short time window. This pattern is indicative of a complex, multi-stage dropper or malware execution flow.