Suspicious WMIC Loading Scripting Libraries (via image_load)

title: Suspicious WMIC Loading Scripting Libraries (via image_load)
id: d52455bd-4b60-5ad7-b506-a3c7e7b2c486
status: stable
description: This rule detects threat actors proxy running code and bypassing application controls by abusing wmic and the `/FORMAT` argument switch to download and execute an XSL file (i.e js, vbs, etc). It could be an indicator of SquiblyTwo technique, which uses Windows Management Instrumentation (WMI) to execute hostile code.
references:
    - https://attack.mitre.org/techniques/T1220/
    - https://securitydatasets.com/notebooks/atomic/windows/defense_evasion/SDWIN-201017061100.html
    - https://twitter.com/dez_/status/986614411711442944
    - https://lolbas-project.github.io/lolbas/Binaries/Wmic/
author: Huntrule Team
date: 2026-06-21
tags:
    - attack.stealth
    - attack.t1220
logsource:
    category: image_load
    product: windows
detection:
    selection:
        Image|endswith: '\wmic.exe'
        ImageLoaded|endswith:
            - '\jscript.dll'
            - '\vbscript.dll'
    condition: selection
falsepositives:
    - Unknown
level: medium