LausivLoader: WSH-spawned PowerShell using env var Kv-named data handoff

Ibrahim Saud@tektrix

•updated 15 days ago•0•0•3

Detects execution of PowerShell scripts spawned by wscript.exe or cscript.exe that retrieve configuration data or file paths from process-specific environment variables, a technique observed in LausivLoader to evade command-line monitoring.