WScript/CScript Script Engine HTTP/HTTPS Network Contact (T1059.005)

Ankit Mehta@Secvyn

•updated Jun 29, 2026•1•0•2

Detects instances where the Windows script hosts wscript.exe or cscript.exe establish outbound network connections to common web ports (HTTP/HTTPS) on external IP addresses. This behavior is frequently associated with script-based malware, droppers, or C2 beacons.