Windows Script and LOLBins Loading .NET CLR DLLs via clr.dll, mscoree.dll, mscorlib.dll

Alerts when common scripting/execution binaries load .NET CLR DLLs like clr.dll and mscoree.dll on Windows.

FreeReviewedSigma · High · v2

Product: windows
Category: image_load
Author: omkar72, oscd.community (SigmaHQ), DRL 1.1
Published: 2020-10-14
Updated: 2026-07-31

ATT&CK techniques

Priv Esc → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
- T1055Process Injection
Defense Evasion
- T1055Process Injection
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows scripting-related binaries (including cscript, wscript, mshta, msxsl, regsvr32, wmic, and cmstp) that load .NET Common Language Runtime components such as clr.dll, mscoree.dll, or mscorlib.dll. Attackers can use script execution and signed/legitimate utilities to trigger .NET CLR loading, which may support stealthy execution or in-memory activity. It relies on image load telemetry indicating the executing process image path and the loaded module DLL path endings.

Reporting behind it

Related detections9 linkedT1055 — drag to rearrange

Suspicious vbc.exe Spawned by Installer Process

Suspicious Office Application Spawning Script Or Shell Interpreter

Suspicious Network Connection From wabmig.exe (Turian Injection)

Suspicious Outbound Network Connection from Explorer Process

Suspicious AppLaunch.exe Spawned As Injection Target (via process_creation)

Suspicious BugSleep Marker File in Public Directory

Suspicious CRAT Injection Named Pipe ChromeUpdatePipe (via pipe_created)

AsyncRAT Injector libPK.dll Written to Public Folder (via file_event)

FlawedGrace spawning threat injection target

Windows Script and LOLBins Loading .NET CLR DLLs via clr.dll, mscoree.dll, mscorlib.dll

Pivot detection · T1055 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-scripting-and-lolbins-loading-net-clr-dlls-4508a70e

title: Windows Script and LOLBins Loading .NET CLR DLLs via clr.dll, mscoree.dll, mscorlib.dll
id: 8cb79bb7-90fc-4c80-a8a0-4907c521ec9e
status: test
description: This rule flags Windows scripting-related binaries (including cscript, wscript, mshta, msxsl, regsvr32, wmic, and cmstp) that load .NET Common Language Runtime components such as clr.dll, mscoree.dll, or mscorlib.dll. Attackers can use script execution and signed/legitimate utilities to trigger .NET CLR loading, which may support stealthy execution or in-memory activity. It relies on image load telemetry indicating the executing process image path and the loaded module DLL path endings.
references:
  - https://github.com/tyranid/DotNetToJScript
  - https://thewover.github.io/Introducing-Donut/
  - https://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html
  - https://web.archive.org/web/20221026202428/https://gist.github.com/code-scrap/d7f152ffcdb3e0b02f7f394f5187f008
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_susp_script_dotnet_clr_dll_load.yml
author: omkar72, oscd.community, Huntrule Team
date: 2020-10-14
modified: 2023-02-23
tags:
  - attack.execution
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1055
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith:
      - \cmstp.exe
      - \cscript.exe
      - \mshta.exe
      - \msxsl.exe
      - \regsvr32.exe
      - \wmic.exe
      - \wscript.exe
    ImageLoaded|endswith:
      - \clr.dll
      - \mscoree.dll
      - \mscorlib.dll
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 4508a70e-97ef-4300-b62b-ff27992990ea
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL