Windows MMC Loading Script Engine DLLs (vbscript/jscript)

Alerts when mmc.exe loads vbscript/jscript script engine DLLs, which can indicate script execution in a trusted process.

FreeUnreviewedSigmamediumv1

windows-mmc-loading-script-engine-dlls-vbscript-jscript-a9c73e8b

title: Windows MMC Loading Script Engine DLLs (vbscript/jscript)
id: c18055b1-c40c-4009-a29c-cbfbc7cdeed7
status: experimental
description: This rule flags instances where MMC loads script engine libraries such as vbscript.dll, jscript.dll, or jscript9.dll. Attackers may abuse trusted MMC to run or stage script-based payloads while blending into legitimate process activity. The detection relies on image load telemetry showing DLLs loaded by mmc.exe on Windows.
references:
  - https://tria.ge/241015-l98snsyeje/behavioral2
  - https://www.elastic.co/security-labs/grimresource
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_win_mmc_loads_script_engine_dll.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-02-05
tags:
  - attack.execution
  - attack.stealth
  - attack.t1059.005
  - attack.t1218.014
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith: \mmc.exe
    ImageLoaded|endswith:
      - \vbscript.dll
      - \jscript.dll
      - \jscript9.dll
  condition: selection
falsepositives:
  - Legitimate MMC operations or extensions loading these libraries
level: medium
license: DRL-1.1
related:
  - id: a9c73e8b-3b2d-4c45-8ef2-5f9a9c9998ad
    type: derived

What it detects

This rule flags instances where MMC loads script engine libraries such as vbscript.dll, jscript.dll, or jscript9.dll. Attackers may abuse trusted MMC to run or stage script-based payloads while blending into legitimate process activity. The detection relies on image load telemetry showing DLLs loaded by mmc.exe on Windows.

Known false positives

Legitimate MMC operations or extensions loading these libraries

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.