Darkcloud Stealer Js To Powershell Execution
Detects the execution of PowerShell by (wscript.exe/cscript.exe), specifically targeting a PowerShell script in the C:\Temp directory. This behavior is consistent with the initial stages of the DarkCloud Stealer infection chain where a JS/WSF downloader executes a fetched PowerShell script.
YARA-L
