Kimsuky NUKESPED JSE Loader Spawning Hidden PowerShell via WScript
Detects instances where wscript.exe or cscript.exe (commonly used to execute JSE files) spawns powershell.exe with command-line arguments indicative of the Kimsuky NUKESPED malware loader. The detection specifically looks for the combination of hidden window, base64 decoding flags, and execution from or manipulation of paths within C:\ProgramData.
YARA-L
