SmarterMail CVE-2026-24423 curl VBS dropper chain run via cmd.exe

ills3c Intel&Coffee@Ills3C

•updated yesterday•5•0•6

Detects a cmd.exe one-liner that downloads a VBS file with curl into TEMP, runs it with cscript, and deletes it, matching the CVE-2026-24423 CommandMount payload. The strict regex on the full chain keeps false positives low.