Microsoft Scripting Process Loading WMI Modules

This analytic detects when Microsoft scripting processes, specifically wscript.exe or cscript.exe, load dynamic link libraries (DLLs) associated with Windows Management Instrumentation (WMI). This activity is identified using Sysmon EventCode 7. The loading of WMI modules by scripting engines can be indicative of malicious behavior, such as that observed in FIN7 implant campaigns, where JavaScript is used to execute WMI queries for host information gathering and subsequent exfiltration to a command and control server. Successful exploitation could lead to system information collection and persistence within the environment.