
title: Suspcious CLR Logs Creation
author: omkar72, oscd.community, Wojciech Lesicki
date: 2020/10/12
description: Detects suspicious .NET assembly executions. Could detect using Cobalt
  Strike's command execute-assembly.
detection:
  SELECTION_1:
    EventID: 11
  SELECTION_2:
    TargetFilename: '*\AppData\Local\Microsoft\CLR*'
  SELECTION_3:
    TargetFilename: '*\UsageLogs\\*'
  SELECTION_4:
    TargetFilename:
    - '*mshta*'
    - '*cscript*'
    - '*wscript*'
    - '*regsvr32*'
    - '*wmic*'
    - '*rundll32*'
    - '*svchost*'
  condition: (SELECTION_1 and SELECTION_2 and SELECTION_3 and SELECTION_4)
falsepositives:
- https://twitter.com/SBousseaden/status/1388064061087260675 - rundll32.exe with zzzzInvokeManagedCustomActionOutOfProc
  in command line and msiexec.exe as parent process
id: e4b63079-6198-405c-abd7-3fe8b0ce3263
level: high
logsource:
  category: file_event
  definition: Check your sysmon configuration for monitoring UsageLogs folder. In
    SwiftOnSecurity configuration we have that thanks @SBousseaden
  product: windows
modified: 2021/11/17
references:
- https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html
- https://bohops.com/2021/03/16/investigating-net-clr-usage-log-tampering-techniques-for-edr-evasion/
- https://github.com/olafhartong/sysmon-modular/blob/master/11_file_create/include_dotnet.xml
status: experimental
tags:
- attack.execution
- attack.defense_evasion
- attack.t1059.001
- attack.t1218
ruletype: SIGMA
