id: e48f1431-7fc4-44bf-87ad-80a56f40d3be
description: N/A
date: 2025-11-28
author: Swachchhanda Shrawan Poudel (Nextron Systems)
rule_metadata:
    - id: 0f60b28c-64dd-4e2c-9a63-5334d3e3a6e6
      title: Script Interpretor Spawning Credential Scanner - Windows
regression_tests_info:
    - name: Positive Detection Test
      type: evtx
      provider: Microsoft-Windows-Sysmon
      path: regression_data/rules/windows/process_creation/proc_creation_win_susp_script_interpretor_spawn_credential_scanner/0f60b28c-64dd-4e2c-9a63-5334d3e3a6e6.evtx
