Skeleton Spider (FIN6) - WScript/CScript JavaScript Execution
Detects suspicious execution of JavaScript via WScript or CScript, often indicative of initial access malware delivery by Skeleton Spider (FIN6) using .LNK files. This aligns with the "More_eggs Malware Delivery Chain" where .LNK files execute hidden JavaScript using wscript.exe.
Sigma
