Outbound Network Connection Initiated By Script Interpreter
This rule detects outbound network connections initiated by the Windows Script Host interpreters, wscript.exe or cscript.exe, to non-local IP addresses. This behavior is often indicative of adversaries using scripts to download additional malicious payloads or establish command and control. The rule filters out connections to common private and loopback IP ranges to reduce false positives.
Sigma
