{"id":"4508a70e-97ef-4300-b62b-ff27992990ea","title":"DotNet CLR DLL Loaded By Scripting Applications","description":"Detects .NET CLR DLLs being loaded by scripting applications such as wscript or cscript. This could be an indication of potential suspicious execution.","author":"omkar72, oscd.community","status":"test","level":"high","date":"2020-10-14","modified":"2023-02-23","tags":["attack.execution","attack.privilege-escalation","attack.stealth","attack.t1055"],"technique_ids":["T1055"],"logsource":{"category":"image_load","product":"windows"},"falsepositives":["Unknown"],"references":["https://github.com/tyranid/DotNetToJScript","https://thewover.github.io/Introducing-Donut/","https://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html","https://web.archive.org/web/20221026202428/https://gist.github.com/code-scrap/d7f152ffcdb3e0b02f7f394f5187f008"],"source_path":"rules/windows/image_load/image_load_susp_script_dotnet_clr_dll_load.yml","source_sha256":"d4607e1f2e0bba95511bed9a6cdeb32242943f73a9c10388f9d99f67669f0038","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/image_load/image_load_susp_script_dotnet_clr_dll_load.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: DotNet CLR DLL Loaded By Scripting Applications\nid: 4508a70e-97ef-4300-b62b-ff27992990ea\nstatus: test\ndescription: Detects .NET CLR DLLs being loaded by scripting applications such as wscript or cscript. This could be an indication of potential suspicious execution.\nreferences:\n    - https://github.com/tyranid/DotNetToJScript\n    - https://thewover.github.io/Introducing-Donut/\n    - https://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html\n    - https://web.archive.org/web/20221026202428/https://gist.github.com/code-scrap/d7f152ffcdb3e0b02f7f394f5187f008\nauthor: omkar72, oscd.community\ndate: 2020-10-14\nmodified: 2023-02-23\ntags:\n    - attack.execution\n    - attack.privilege-escalation\n    - attack.stealth\n    - attack.t1055\nlogsource:\n    category: image_load\n    product: windows\ndetection:\n    selection:\n        Image|endswith:\n            - '\\cmstp.exe'\n            - '\\cscript.exe'\n            - '\\mshta.exe'\n            - '\\msxsl.exe'\n            - '\\regsvr32.exe'\n            # - '\\svchost.exe'\n            - '\\wmic.exe'\n            - '\\wscript.exe'\n        ImageLoaded|endswith:\n            - '\\clr.dll'\n            - '\\mscoree.dll'\n            - '\\mscorlib.dll'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1055","id":"T1055","name":"Process Injection","page":"techniques/enterprise/T1055/"}],"data_path":"data/detection-rules/4508a70e-97ef-4300-b62b-ff27992990ea.json","kind":"sigma"}