FakeUpdates/SocGholish Activity

Detects initial execution of FakeUpdates/SocGholish malware via wscript that later executes commands via cmd or powershell.