Windows: Scripting and LOLBins Loading .NET CLR DLLs

title: "Windows: Scripting and LOLBins Loading .NET CLR DLLs"
id: 8cb79bb7-90fc-4c80-a8a0-4907c521ec9e
status: test
description: This rule flags Windows processes used for scripting or execution (including wscript, cscript, mshta, msxsl, regsvr32, wmic, and cmstp) that load .NET CLR-related DLLs such as clr.dll, mscoree.dll, and mscorlib.dll. Attackers may use these living-off-the-land style tools to execute .NET code while blending into normal system activity. It relies on image load telemetry that records the loaded module path for the initiating process.
references:
  - https://github.com/tyranid/DotNetToJScript
  - https://thewover.github.io/Introducing-Donut/
  - https://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html
  - https://web.archive.org/web/20221026202428/https://gist.github.com/code-scrap/d7f152ffcdb3e0b02f7f394f5187f008
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_susp_script_dotnet_clr_dll_load.yml
author: omkar72, oscd.community, Huntrule Team
date: 2020-10-14
modified: 2023-02-23
tags:
  - attack.execution
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1055
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith:
      - \cmstp.exe
      - \cscript.exe
      - \mshta.exe
      - \msxsl.exe
      - \regsvr32.exe
      - \wmic.exe
      - \wscript.exe
    ImageLoaded|endswith:
      - \clr.dll
      - \mscoree.dll
      - \mscorlib.dll
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 4508a70e-97ef-4300-b62b-ff27992990ea
    type: derived