SigmaHQ/rules/windows/file_event/sysmon_susp_clr_logs.yml

title: Suspcious CLR Logs Creation
id: e4b63079-6198-405c-abd7-3fe8b0ce3263
description: Detects suspicious .NET assembly executions 
references:
  - https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html
date: 2020/10/12
tags:
  - attack.execution
  - attack.t1059.001
status: experimental
author: omkar72, oscd.community
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 11
        TargetFilename|contains:
          - '\AppData\Local\Microsoft\CLR*\UsageLogs\mshta*'
          - '\AppData\Local\Microsoft\CLR*\UsageLogs\cscript*'
          - '\AppData\Local\Microsoft\CLR*\UsageLogs\wscript*'
          - '\AppData\Local\Microsoft\CLR*\UsageLogs\regsvr32*'
          - '\AppData\Local\Microsoft\CLR*\UsageLogs\wmic*'
    condition: selection
falsepositives:
  - Unknown
level: high