Local Network Connection Initiated By Script Interpreter
Detects a script interpreter (Wscript/Cscript) initiating a local network connection to download or execute a script hosted on a shared folder. This behavior can be indicative of an adversary attempting to transfer tools or execute scripts from internal network shares.
Sigma
