Outbound Network Connection Initiated By Script Interpreter

SigmaHQ Detections@sigmaHQ

•updated Mar 13, 2024•0•0•1

Detects a script interpreter wscript/cscript opening a network connection to a non-local network. Adversaries may use script to download malicious payloads.