Windows: Detect WMIC loading JavaScript or VBScript libraries via image load events

Alerts on wmic.exe loading jscript.dll or vbscript.dll, a common sign of script execution via Windows Management Instrumentation.

FreeUnreviewedSigmamediumv1

windows-detect-wmic-loading-javascript-or-vbscript-libraries-via-image-load-even-06ce37c2

title: "Windows: Detect WMIC loading JavaScript or VBScript libraries via image load events"
id: 7a44d21b-f77d-40b6-b367-728bdaebab38
related:
  - id: 8d63dadf-b91b-4187-87b6-34a1114577ea
    type: similar
  - id: 05c36dd6-79d6-4a9a-97da-3db20298ab2d
    type: similar
  - id: 06ce37c2-61ab-4f05-9ff5-b1a96d18ae32
    type: derived
status: test
description: This rule flags when wmic.exe is loaded and it loads scripting libraries (jscript.dll or vbscript.dll). Such library loading is significant because it can indicate WMIC being used to run script content rather than only perform benign management queries. The detection relies on image load telemetry that records the executable name and the DLLs loaded into its process context.
references:
  - https://securitydatasets.com/notebooks/atomic/windows/defense_evasion/SDWIN-201017061100.html
  - https://twitter.com/dez_/status/986614411711442944
  - https://lolbas-project.github.io/lolbas/Binaries/Wmic/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_wmic_remote_xsl_scripting_dlls.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule Team
date: 2020-10-17
modified: 2022-10-13
tags:
  - attack.stealth
  - attack.t1220
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith: \wmic.exe
    ImageLoaded|endswith:
      - \jscript.dll
      - \vbscript.dll
  condition: selection
falsepositives:
  - The command wmic os get lastbootuptime loads vbscript.dll
  - The command wmic os get locale loads vbscript.dll
  - Since the ImageLoad event doesn't have enough information in this case. It's better to look at the recent process creation events that spawned the WMIC process and investigate the command line and parent/child processes to get more insights
  - The command `wmic ntevent` loads vbscript.dll
level: medium
license: DRL-1.1

What it detects

This rule flags when wmic.exe is loaded and it loads scripting libraries (jscript.dll or vbscript.dll). Such library loading is significant because it can indicate WMIC being used to run script content rather than only perform benign management queries. The detection relies on image load telemetry that records the executable name and the DLLs loaded into its process context.

Known false positives

The command wmic os get lastbootuptime loads vbscript.dll
The command wmic os get locale loads vbscript.dll
Since the ImageLoad event doesn't have enough information in this case. It's better to look at the recent process creation events that spawned the WMIC process and investigate the command line and parent/child processes to get more insights
The command `wmic ntevent` loads vbscript.dll

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.