Renamed AutoIt Interpreter Launched via WScript VBScript under DriveOptimize Directory
Detects wscript.exe executing OptiDrive.vbs from the %LOCALAPPDATA%\DriveOptimize Technologies\ masquerade directory to invoke the renamed AutoIt interpreter OptiDrive.exe — the ACRStealer staging/masquerade technique.
Cortex XDR
