StopAndProtect VBS Spreader RegisterRC6inPlace.vbs WMI Lateral Movement
Detects the StopAndProtect VBS spreader (RegisterRC6inPlace.vbs / Payloadvbs.b64) propagating via removable media and/or WMI remote process creation.
Microsoft Sentinel (KQL)
Detects the StopAndProtect VBS spreader (RegisterRC6inPlace.vbs / Payloadvbs.b64) propagating via removable media and/or WMI remote process creation.
Already have an account?