WSF/HTA Script Spawns Encoded PowerShell (HEAVYGRAM Loader)

Ibrahim Saud@tektrix

•updated 22 days ago•0•0•3

This rule detects instances where Windows scripting engines (WScript or MSHTA) execute script files (WSF, VBS, HTA) which subsequently spawn a PowerShell process using encoded command arguments. This pattern is commonly used by adversaries to mask malicious payloads and bypass execution policy or simple command-line monitoring.