.NET Loader - VBScript Decoding Stage (T1140)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•0•0•2

Maps the execution of a VBScript payload decrypting the subsequent stages using hardcoded arrays. This rule specifically looks for VBScript commands that use the 'Split' function in conjunction with 'ChrW', which is a common pattern for obfuscated VBScript decoding routines.