Suspicious PowerShell or Script Execution Connecting to WhatsApp Domains

Ankit Mehta@Secvyn

•updated Jun 25, 2026•0•0•1

This rule detects outbound network connections to WhatsApp (whatsapp.com or wa.me) initiated by common scripting engines (powershell.exe, wscript.exe, cscript.exe). Such activity from these processes is anomalous in typical enterprise environments and may indicate the use of scripts for account compromise, C2 communication, or exfiltration via messaging platforms.