Suspicious DNS Queries from VBScript Runner

Ankit Mehta@Secvyn

•updated Jun 23, 2026•0•0•3

This rule detects suspicious DNS queries originating from VBScript (wscript.exe or cscript.exe) processes. It specifically filters out common legitimate domains like Microsoft, Windows, and Google to reduce noise, aiming to identify potential phishing or malware activity leveraging VBScript for network communication.