Outbound SMTPS Connection from Script Host

Shikha Sangwan@ssangwan

•updated Mar 30, 2026•5•1•421

Detects native Windows scripting hosts (wscript.exe, cscript.exe) establishing outbound network connections over SMTPS (port 465). This is highly anomalous and was observed in the FAUX#ELEVATE campaign where threat actors exfiltrated stolen credentials and browser data using Collaboration Data Objects (CDO) via VBScript to external SMTP servers.