Windows: CLR DLL Loaded by Microsoft Office Applications

title: "Windows: CLR DLL Loaded by Microsoft Office Applications"
id: 5f7b2557-5c23-41bc-82e0-6f6b6d6e52f4
status: test
description: This rule flags image load events where an Office application process loads the Windows CLR DLL (clr.dll). Attackers may use the CLR to execute .NET-related code within the context of a legitimate Office binary, helping execution and tradecraft. The detection relies on Windows image load telemetry that records the loading process image path and the loaded module path containing clr.dll.
references:
  - https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_office_dotnet_clr_dll_load.yml
author: Antonlovesdnb, Huntrule Team
date: 2020-02-19
modified: 2023-03-29
tags:
  - attack.execution
  - attack.t1204.002
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith:
      - \excel.exe
      - \mspub.exe
      - \outlook.exe
      - \onenote.exe
      - \onenoteim.exe
      - \powerpnt.exe
      - \winword.exe
    ImageLoaded|contains: \clr.dll
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: d13c43f0-f66b-4279-8b2c-5912077c1780
    type: derived