Network Connection from VBScript Runner to External IPs

Ankit Mehta@Secvyn

•updated Jun 23, 2026•0•0•4

This rule detects network connections initiated by VBScript (wscript.exe or cscript.exe) to external IP addresses. This behavior can be indicative of malicious VBScript execution attempting to communicate with command and control servers or exfiltrate data, often associated with phishing attacks.