wsf file executed by cscript.exe

Salten Fisk@saltenfisk

•updated Jul 16, 2025•1•1•27

This package searches endpoint processes for cscript executing a wsf file which has been attributed to the Serpentine#Cloud campaign. This is a brittle detection narrowly defined to this particular campaign but is nonetheless useful.