Suspicious VBScript DNS Query to AI API Domains
Detects Windows VBScript processes (wscript.exe or cscript.exe) performing DNS queries for AI/LLM API domains. This behavior is a key indicator of malware like PROMPTFLUX and WormGPT, which leverage these APIs for dynamic code generation and evasion. This activity is highly suspicious as VBScript engines rarely perform external network operations to these types of services. Sysmon event id 22 is the best way to detect this behavior on endpoints.
Sigma
