VBScript Dropper Correlated with WMI Hidden Process & Silent MSI Install
Detects a correlated sequence where an unsigned cscript.exe/wscript.exe process executes a .vbs script, WMI-based hidden process creation is observed, and msiexec.exe performs a silent MSI installation, consistent with the SMOKE#SCREEN VBScript dropper chain that uses WMI to silently install a ScreenConnect MSI payload.
Cortex XDR
