T1553.005: Trigram Windows Dropper Strips MOTW and Launches Hidden wscript Worke

Tim Peck@timpeck

•updated today•1•0•34

Detects the Trigram (Kimsuky/UNK_DeadDrop, OverLord) Windows dropper pattern where cmd.exe or PowerShell strips the Mark-of-the-Web via Unblock-File or Zone.Identifier removal, followed on the same host by the execution of a hidden VBScript worker using wscript //B.