WScript executing find.vbs from Temp (fake GTA6 installer license error)
Detects the execution of wscript.exe or cscript.exe executing a script named 'find.vbs' located within a user's temporary directory. It looks for suspicious parent processes or conditions often associated with malicious installers or lures.
Splunk (SPL)
