Kimsuky JSE Loader: WScript/CScript Spawning Hidden PowerShell with certutil Decode

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects instances where PowerShell is spawned by Windows Script Host processes (wscript.exe or cscript.exe) with suspicious command-line arguments indicative of fileless execution or payload decoding, such as the use of hidden windows, encoded commands, or certutil-based file decoding from the ProgramData directory.