Windows WMIC loading JavaScript/VBScript engine libraries
Alerts on wmic.exe loading jscript.dll or vbscript.dll, a common sign of script execution via Windows Management Instrumentation.
- Product
- windows
- Category
- image_load
- Author
- Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) (SigmaHQ), DRL 1.1
- Published
- 2020-10-17
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows processes that load wmic.exe and subsequently load the scripting runtime libraries jscript.dll or vbscript.dll. Such library loading indicates WMIC is being used to execute or proxy scripting functionality, which can help attackers bypass application controls. The detection relies on image load telemetry (the loaded module paths) that associates script engine DLL loads with WMIC execution. Investigate the parent process and command line around the WMIC invocation to confirm intent, as benign WMIC queries can also trigger vbscript.dll loads.
Reporting behind it
- securitydatasets.comhttps://securitydatasets.com/notebooks/atomic/windows/defense_evasion/SDWIN-201017061100.html
- twitter.comhttps://twitter.com/dez_/status/986614411711442944
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/Binaries/Wmic/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_wmic_remote_xsl_scripting_dlls.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows WMIC loading JavaScript/VBScript engine libraries
id: 7a44d21b-f77d-40b6-b367-728bdaebab38
related:
- id: 8d63dadf-b91b-4187-87b6-34a1114577ea
type: similar
- id: 05c36dd6-79d6-4a9a-97da-3db20298ab2d
type: similar
- id: 06ce37c2-61ab-4f05-9ff5-b1a96d18ae32
type: derived
status: test
description: This rule identifies Windows processes that load wmic.exe and subsequently load the scripting runtime libraries jscript.dll or vbscript.dll. Such library loading indicates WMIC is being used to execute or proxy scripting functionality, which can help attackers bypass application controls. The detection relies on image load telemetry (the loaded module paths) that associates script engine DLL loads with WMIC execution. Investigate the parent process and command line around the WMIC invocation to confirm intent, as benign WMIC queries can also trigger vbscript.dll loads.
references:
- https://securitydatasets.com/notebooks/atomic/windows/defense_evasion/SDWIN-201017061100.html
- https://twitter.com/dez_/status/986614411711442944
- https://lolbas-project.github.io/lolbas/Binaries/Wmic/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_wmic_remote_xsl_scripting_dlls.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule Team
date: 2020-10-17
modified: 2022-10-13
tags:
- attack.stealth
- attack.t1220
logsource:
category: image_load
product: windows
detection:
selection:
Image|endswith: \wmic.exe
ImageLoaded|endswith:
- \jscript.dll
- \vbscript.dll
condition: selection
falsepositives:
- The command wmic os get lastbootuptime loads vbscript.dll
- The command wmic os get locale loads vbscript.dll
- Since the ImageLoad event doesn't have enough information in this case. It's better to look at the recent process creation events that spawned the WMIC process and investigate the command line and parent/child processes to get more insights
- The command `wmic ntevent` loads vbscript.dll
level: medium
license: DRL-1.1