huntrule

Malicious Emmenhtal JavaScript Loader Spawning Encoded PowerShell

PremiumReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-09-11
Updated
2026-09-11
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects wscript.exe or cscript.exe executing a .js file and spawning PowerShell with an encoded command. The Emmenhtal loader used in this MaaS operation against Ukrainian entities runs JavaScript such as Work.js via WScript.Shell to launch encoded PowerShell that fetches the Amadey payload, so this script-to-encoded-PowerShell chain is the core delivery behavior.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange
Suspicious XOR Obfuscated PowerShell from ClickFix Distribution
Suspicious Script Host Spawning PowerShell Download Cradle (via process_creation)
Suspicious PowerShell Executing Code from Environment Variable (via process_creation)
Suspicious In-Memory Runspace Execution via PowerShell Script Block
Suspicious Encoded PowerShell Using Base64 Stream Decompression Routines (via process_creation)
Suspicious PowerShell Spawned by Windows Script Host during Scarlet Goldfinch Infection (via process_creation)
Suspicious PowerShell In-Memory Execution with AES Decryption
Suspicious Encoded PowerShell Command Execution
Suspicious node.exe Executing Compiled JavaScript Bytecode File
Malicious Emmenhtal JavaScript Loader Spawning Encoded PowerShell
Pivot detection · T1059.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.