JScript Dropper Writes Base64 PowerShell Script to C:\Temp via wscript.exe

Duo Tech@duotech

•updated Jun 30, 2026•0•0•0

Detects wscript.exe executing PowerShell to run a script dropped into the C:\Temp directory. This behavior is consistent with common JScript dropper infection chains, such as Amadey or StealC, which use WScript to decode and execute Base64 payloads from temporary files using hidden windows and bypassed execution policies.