VBScript or legacy Visual Basic runtime loaded into a process

Siemphony@siemphonymediumT1059.005verified in lab

Matches AN0209's ModuleName knob directly: `vbscript.dll`, the classic VBScript engine that wscript.exe, cscript.exe, mshta.exe and Internet Explorer load to run a .vbs/.vbe file or inline VBScript in an HTA, plus `msvbvm60.dll`, the VB6 p-code runtime any legacy compiled VB6 executable pulls in at launch. This is written on image_load rather than on the Office-spawns-script-host chain AN0209 also describes, because that parent/child pattern is already the corpus's T1204 rule; a module load is a narrower, technique-specific signal that fires regardless of what launched the host process, including a VBScript engine loaded directly by a compiled binary with no visible script-host parent at all. It says nothing about what the script did — VBA macro execution inside vbe7.dll is a different engine entirely and is invisible to this rule. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0076, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceImageLoadEvents| where (FolderPath endswith "\\vbscript.dll" or FolderPath endswith "\\msvbvm60.dll")

Splunk · SPL

Run this as a search.

index=* (ImageLoaded="*\\vbscript.dll" OR ImageLoaded="*\\msvbvm60.dll")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(file.path) LIKE "*\\\\vbscript.dll" OR TO_LOWER(file.path) LIKE "*\\\\msvbvm60.dll")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,image_load,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="ImageLoaded" type="pcre2">(?i)(\\vbscript\.dll$|\\msvbvm60\.dll$)</field>    <description>VBScript or legacy Visual Basic runtime loaded into a process</description>    <mitre>      <id>T1059.005</id>    </mitre>  </rule></group>

At a glance

Logsource: image_load / windows
Level: medium
Category: script_interpreter_execution
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 30add5e6-a6a2-4cf7-bda1-e7267b48e0ed

ATT&CKT1059.005

T1059.005Visual Basic

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonscript interpreter execution

script interpreter executionAI draft — unreviewed

01 · What this rule detects

AN0209 describes VBScript/VBA/VBScript execution broadly: cscript.exe/wscript.exe invocation, Office-to-script-host process chains, HTA abuse. This rule covers none of that chain — it fires on a single Sysmon EventID 7 module load of vbscript.dll (the classic VBScript engine) or msvbvm60.dll (the VB6 p-code runtime). That makes it a precursor/behavioral signal independent of parentage: it catches a VBScript engine loaded directly by a compiled binary with no script-host parent visible at all, but it also deliberately skips the Office-spawns-script-host pattern, which this corpus already covers under T1204. It says nothing about what ran — VBA macro execution loads vbe7.dll, a different engine entirely, and is invisible here.

02 · Telemetry you need

Sysmon EventID 7 (category: image_load) — not part of Sysmon's default config and aggressively filtered out of common community baselines (SwiftOnSecurity included) purely for volume. An <ImageLoad onmatch="include"> rule covering these two DLLs has to be added explicitly, or this rule sees nothing and that silence reads as "clean" rather than "not collected." Splunk, Elastic ESQL, and Wazuh all render the query; Sentinel refuses outright because it has no table modeled for image_load — a backend coverage gap, not a defect in this rule.

03 · How the logic works

One selection block, one field: ImageLoaded|endswith against two literal strings, \vbscript.dll and \msvbvm60.dll, ANDed into a single condition. MITRE's ModuleName knob (AN0209) names the category — "vbscript.dll, scrrun.dll, or other scripting engine modules" — but the two concrete values here are the author's own selection, not MITRE's: scrrun.dll (FileSystemObject, too broadly legitimate to include) and vbe7.dll/VBA are both left out by choice, the latter because it's a distinct engine outside this rule's stated scope. No process-chain correlation is attempted; that's intentional, not a gap, since the chain belongs to T1204.

04 · Common false positives

The four documented sources are real and specific: IE/Edge in IE-mode against legacy intranet apps that still ship classic VBScript (loads on every page render); GPO logon/logoff/startup scripts (once per session, every affected host); VB6 line-of-business software (unconditional at launch); HTA-based setup wizards. The reviewer's sharper catch is what's missing: enterprise deployment tooling — SCCM/MECM and Intune — routinely pushes VBScript install/detection scripts through cscript.exe running as SYSTEM, firing fleet-wide on every patch or deployment window. That's plausibly a higher-volume benign source than all four listed causes combined, and it's the central gap to close before trusting this rule's noise profile.

05 · Detection maturity

tier_1: .** Machine-derived from a MITRE scaffold and never executed against real logs. The evasion path above (renaming the DLL) and the missing SCCM/Intune false positive were both found through static review, not observed hit volume — actual noise levels, and whether the ImageLoad prerequisite is even met in a given environment, remain unknown until this runs read-only against real telemetry.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Verify the ImageLoad include filter is actually deployed before treating
Add SCCM/Intune-driven script deployment as a named suppression entry; it's
The match is filename-only — no hash or signer check. Copying either DLL
Expect declining hit rate over time: Windows 11 24H2+ disables the classic
The corpus still has no image_load coverage for VBA itself (vbe7.dll/

Declared by the author

Internet Explorer or Edge running in IE mode against a legacy intranet application that still contains classic VBScript, which loads vbscript.dll on every page render and is common wherever such an application has not been retired.
Group Policy logon, logoff or startup scripts authored in VBScript, which run through wscript.exe or cscript.exe on every interactive session and load vbscript.dll once per logon on every affected host.
Legacy line-of-business software compiled against Visual Basic 6, which loads msvbvm60.dll unconditionally at every launch regardless of what the program does.
HTA-based setup wizards and internal tooling that embed VBScript for their UI logic, loading vbscript.dll through mshta.exe as part of ordinary software installation.

Noise check0 of 2 fired

Fires on none of the 2 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 2 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification2 runs

Verified in Siemphony lab

Security Datasets — VBScript launcher executed for initial access (Empire)
passed
Siemphony IR · 3 Sept 2026
1 true · 0 false · 0.0% noise
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1059.005, evaluated against their image_load events.

Share this rule

/u/siemphony/30add5e6-a6a2-4cf7-bda1-e7267b48e0ed

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

VBScript or legacy Visual Basic runtime loaded into a process

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it