Suspicious DLL Loading by VBScript

Ankit Mehta@Secvyn

•updated Jun 23, 2026•1•0•1

This rule detects suspicious loading of common DLLs (mshtml.dll, mscoree.dll, clr.dll, kernel32.dll, advapi32.dll) by VBScript interpreters (wscript.exe or cscript.exe). This activity can be indicative of phishing attacks or malicious script execution attempting to interact with system components or the .NET framework.