
title: CLR DLL Loaded Via Scripting Applications
author: omkar72, oscd.community
date: 2020/10/14
description: Detects CLR DLL being loaded by an scripting applications
detection:
  SELECTION_1:
    EventID: 7
  SELECTION_2:
    Image:
    - '*\wscript.exe'
    - '*\cscript.exe'
    - '*\mshta.exe'
  SELECTION_3:
    ImageLoaded:
    - '*\clr.dll'
    - '*\mscoree.dll'
    - '*\mscorlib.dll'
  condition: (SELECTION_1 and SELECTION_2 and SELECTION_3)
falsepositives:
- unknown
id: 4508a70e-97ef-4300-b62b-ff27992990ea
level: high
logsource:
  category: image_load
  product: windows
references:
- https://github.com/tyranid/DotNetToJScript
- https://thewover.github.io/Introducing-Donut/
- https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html
status: experimental
tags:
- attack.execution
- attack.privilege_escalation
- attack.t1055
ruletype: SIGMA
