huntrule

Windows MMC Loads Script Engine DLLs (vbscript.dll, jscript.dll, jscript9.dll)

Alerts when mmc.exe loads vbscript/jscript script engine DLLs, which can indicate script execution in a trusted process.

FreeReviewedSigma · Medium · v2
Product
windows
Category
image_load
Author
Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2025-02-05
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule triggers when MMC (mmc.exe) loads script engine DLLs such as vbscript.dll, jscript.dll, and jscript9.dll. Attackers can abuse MMC to execute or host script-based payloads within a trusted Windows process, helping with defense evasion or application control bypass attempts. The detection relies on process image load telemetry that records the loaded DLL path for image_load events on Windows.

Reporting behind it

Related detections9 linkedT1059.005 — drag to rearrange
Malicious mshta Launching WScript VBScript Loader
Suspicious wscript Execution Forcing VBScript Engine in Batch Mode
Suspicious Dism Spawned by Microsoft Management Console (via process_creation)
Suspicious Batch Script Execution Spawned by wscript via VBScript
Suspicious NW.js Runtime Execution from AppData Roaming by Charcoal Stork (via process_creation)
Suspicious WScript VBS Execution from Temp Directory in CVE-2023-36884 Exploit Chain
Suspicious VBScript Execution from ProgramLogs Directory via Windows Script Host
Malicious Script Execution via Cisco AnyConnect OnConnect Handler Abuse
Malicious rundll32 IternalJob Export Spawned by wscript (via process_creation)
Windows MMC Loads Script Engine DLLs (vbscript.dll, jscript.dll, jscript9.dll)
Pivot detection · T1059.005 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.