Suspicious File Execution and Remote Connection Chain

Ankit Mehta@Secvyn

•updated Jun 25, 2026•0•0•1

Detects a potential multi-stage attack sequence where a file (archive or browser-related) is executed, followed by a script interpreter (wscript/cscript), and finally followed by a remote connection to common remote access ports (RDP, FTP, SMB, SSH). The rule correlates these events within a specific timeframe per device to identify likely lateral movement or remote command and control initialization.