BIOC
Informational
✕
Wscript.exe connects to an external network
It may be due to local IT or administrative tools used on endpoints, but it could also indicate exfiltration of data between hosts in the local network, malware droppers, beaconing and so on. The execution chain should be reviewed to determine the context of the activity.
- Module:
- Platform Analytics
- Agent event type:
- Network
- Category:
- Execution
- Status:
- Enabled
ATT&CK tactics: Execution (TA0002)
ATT&CK techniques: Command and Scripting Interpreter: JavaScript (T1059.007)
Indicator:
Network action type = incoming , outgoing , failed AND remote ip != 10.* AND 172.16.* AND 172.17.* AND 172.18.* AND 172.19.* AND 172.20.* AND 172.21.* AND 172.22.* AND 172.23.* AND 172.24.* AND 172.25.* AND 172.26.* AND 172.27.* AND 172.28.* AND 172.29.* AND 172.30.* AND 172.31.* AND 192.168.* AND 127.* AND 169.254.* Process initiated by = wscript.exe , cgo name = wscript.exe
Preventable: yes