title: CLR DLL Loaded Via Scripting Applications
id: 4508a70e-97ef-4300-b62b-ff27992990ea
status: test
description: Detects CLR DLL being loaded by an scripting applications
author: omkar72, oscd.community
references:
  - https://github.com/tyranid/DotNetToJScript
  - https://thewover.github.io/Introducing-Donut/
  - https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html
date: 2020/10/14
modified: 2021/11/27
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
    ImageLoaded|endswith:
      - '\clr.dll'
      - '\mscoree.dll'
      - '\mscorlib.dll'
  condition: selection
falsepositives:
  - Unknown
level: high
tags:
  - attack.execution
  - attack.privilege_escalation
  - attack.t1055
