MS Scripting Process Loading LDAP Modules

This analytic detects the execution of Microsoft scripting processes (wscript.exe or cscript.exe) when they load LDAP-related modules (Wldap32.dll, adsldp.dll, adsldpc.dll). This activity is identified using Sysmon EventCode 7, which logs module loads. Such behavior can indicate an attempt to query LDAP for host information, a technique observed in implants used by threat groups like FIN7. If malicious, this could lead to attackers gathering Active Directory information for further exploitation or data exfiltration.