Windows Script and LOLBins Loading .NET CLR DLLs via clr.dll, mscoree.dll, mscorlib.dll

Alerts when common scripting/execution binaries load .NET CLR DLLs like clr.dll and mscoree.dll on Windows.

FreeReviewedSigma · High · v2

Product: windows
Category: image_load
Author: omkar72, oscd.community (SigmaHQ), DRL 1.1
Published: 2020-10-14
Updated: 2026-07-31

ATT&CK techniques

Priv Esc → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
- T1055Process Injection
Defense Evasion
- T1055Process Injection
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows scripting-related binaries (including cscript, wscript, mshta, msxsl, regsvr32, wmic, and cmstp) that load .NET Common Language Runtime components such as clr.dll, mscoree.dll, or mscorlib.dll. Attackers can use script execution and signed/legitimate utilities to trigger .NET CLR loading, which may support stealthy execution or in-memory activity. It relies on image load telemetry indicating the executing process image path and the loaded module DLL path endings.

Reporting behind it

Related detections9 linkedT1055 — drag to rearrange

Malicious AddInProcess32 Network Beacon on PureRAT C2 Ports

Suspicious Payload Staging in ProgramData IntelDriver Folder (via file_event)

Possible DarkGate Process Injection via iTunesHelper Spawning vbc.exe

Suspicious PowerShell Shellcode Loader via Function Pointer Delegate

Suspicious Named Pipe Created by Kazuar Backdoor for Interprocess Command Channel

Suspicious SmallTiger Backdoor DLL Load via Image Load

Suspicious svchost Execution With Anomalous Arguments via DeedRAT (via process_creation)

Suspicious Sang Loader Execution with Install or PassUAC Arguments

Suspicious GodRAT Shellcode Injection via Puppet Argument (via process_creation)

Windows Script and LOLBins Loading .NET CLR DLLs via clr.dll, mscoree.dll, mscorlib.dll

Pivot detection · T1055 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-scripting-and-lolbins-loading-net-clr-dlls-4508a70e

title: Windows Script and LOLBins Loading .NET CLR DLLs via clr.dll, mscoree.dll, mscorlib.dll
id: 8cb79bb7-90fc-4c80-a8a0-4907c521ec9e
status: test
description: This rule flags Windows scripting-related binaries (including cscript, wscript, mshta, msxsl, regsvr32, wmic, and cmstp) that load .NET Common Language Runtime components such as clr.dll, mscoree.dll, or mscorlib.dll. Attackers can use script execution and signed/legitimate utilities to trigger .NET CLR loading, which may support stealthy execution or in-memory activity. It relies on image load telemetry indicating the executing process image path and the loaded module DLL path endings.
references:
  - https://github.com/tyranid/DotNetToJScript
  - https://thewover.github.io/Introducing-Donut/
  - https://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html
  - https://web.archive.org/web/20221026202428/https://gist.github.com/code-scrap/d7f152ffcdb3e0b02f7f394f5187f008
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_susp_script_dotnet_clr_dll_load.yml
author: omkar72, oscd.community, Huntrule Team
date: 2020-10-14
modified: 2023-02-23
tags:
  - attack.execution
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1055
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith:
      - \cmstp.exe
      - \cscript.exe
      - \mshta.exe
      - \msxsl.exe
      - \regsvr32.exe
      - \wmic.exe
      - \wscript.exe
    ImageLoaded|endswith:
      - \clr.dll
      - \mscoree.dll
      - \mscorlib.dll
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 4508a70e-97ef-4300-b62b-ff27992990ea
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL