.NET Loader - JScript Relocation Sequence (T1059.007)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•0•0•2

Detects the multi-stage loader's evasion tactic where JScript copies itself from a Temp directory to Public and relaunches. Specifically, it looks for wscript.exe executing another wscript.exe process with a command line containing "C:\Users\Public" and "//nologo".