Seedworm Payload Falcon_module63.vbs Execution

Ibrahim Saud@tektrix

•updated Jun 17, 2026•2•0•5

Detects the execution of 'Falcon_module63.vbs', a script associated with the Iranian APT group Seedworm (also known as APT33 or Shamoon). This VBScript is often used in the initial stages of an attack for reconnaissance or to establish persistence.