MMC Loading Script Engines DLLs

Title: MMC Loading Script Engines DLLs
Status: experimental
Description:Detects when the Microsoft Management Console (MMC) loads the DLL libraries like vbscript, jscript etc which might indicate an attempt to execute malicious scripts within a trusted system process for bypassing application whitelisting or defense evasion.
References:
  -https://tria.ge/241015-l98snsyeje/behavioral2
  -https://www.elastic.co/security-labs/grimresource
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-02-05
modified:None
Tags:

• -'attack.execution'
• -'attack.stealth'
• -'attack.t1059.005'
• -'attack.t1218.014'

Logsource:

• category: image_load
• product: windows

Detection:
  selection:
    Image|endswith: '\mmc.exe'
    ImageLoaded|endswith:
      -'\vbscript.dll'
      -'\jscript.dll'
      -'\jscript9.dll'

  condition:selection
Falsepositives:
  -Legitimate MMC operations or extensions loading these libraries
Level: medium