MMC Loading Script Engines DLLs (a9c73e8b-3b2d-4c45-8ef2-5f9a9c9998ad)

Detects when the Microsoft Management Console (MMC) loads the DLL libraries like vbscript, jscript etc which might indicate an attempt to execute malicious scripts within a trusted system process for bypassing application whitelisting or defense evasion.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
MMC Loading Script Engines DLLs (a9c73e8b-3b2d-4c45-8ef2-5f9a9c9998ad)	Sigma-Rules	MMC - T1218.014 (ffbcfdb0-de22-4106-9ed3-fc23c8a01407)	Attack Pattern	1
MMC Loading Script Engines DLLs (a9c73e8b-3b2d-4c45-8ef2-5f9a9c9998ad)	Sigma-Rules	Visual Basic - T1059.005 (dfd7cc1d-e1d8-4394-a198-97c4cab8aa67)	Attack Pattern	1
MMC - T1218.014 (ffbcfdb0-de22-4106-9ed3-fc23c8a01407)	Attack Pattern	System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4)	Attack Pattern	2
Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830)	Attack Pattern	Visual Basic - T1059.005 (dfd7cc1d-e1d8-4394-a198-97c4cab8aa67)	Attack Pattern	2