huntrule

Windows MMC Loads Script Engine DLLs (vbscript.dll, jscript.dll, jscript9.dll)

Alerts when mmc.exe loads vbscript/jscript script engine DLLs, which can indicate script execution in a trusted process.

FreeReviewedSigma · Medium · v2
Product
windows
Category
image_load
Author
Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2025-02-05
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule triggers when MMC (mmc.exe) loads script engine DLLs such as vbscript.dll, jscript.dll, and jscript9.dll. Attackers can abuse MMC to execute or host script-based payloads within a trusted Windows process, helping with defense evasion or application control bypass attempts. The detection relies on process image load telemetry that records the loaded DLL path for image_load events on Windows.

Reporting behind it

Related detections9 linkedT1059.005 — drag to rearrange
Suspicious Script Host Execution of Decoy-Named JavaScript Dropper (PS1Bot)
Malicious PathWiper Loader Script Execution from Windows Temp via WScript
Suspicious Office Application Spawning Script Or Shell Interpreter
Malicious Script Host Spawning PowerShell With Invoke-Expression (via process_creation)
Suspicious MSHTA VBScript WScript Shell Execution
Malicious Kimsuky VBE Payload Download via Curl to AppData and Execution (via process_creation)
Suspicious winrm.vbs LOLBAS Script Execution for Code Proxying
Malicious LitterDrifter VBScript Execution via wscript trash.dll
Suspicious Script Host Spawning PowerShell via BlindEagle Chain
Windows MMC Loads Script Engine DLLs (vbscript.dll, jscript.dll, jscript9.dll)
Pivot detection · T1059.005 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.