Suspicious DotNET CLR Usage Log Artifact
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects the creation of Usage Log files by the CLR (clr.dll). These files are named after the executing process once the assembly is finished executing for the first time in the (user) session context.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "File Created or Modified" AND (FILENAME endswith "\UsageLogs\cmstp.exe.log,\UsageLogs\cscript.exe.log,\UsageLogs\mshta.exe.log,\UsageLogs\msxsl.exe.log,\UsageLogs\regsvr32.exe.log,\UsageLogs\rundll32.exe.log,\UsageLogs\svchost.exe.log,\UsageLogs\wscript.exe.log,\UsageLogs\wmic.exe.log" OR OBJECTNAME endswith "\UsageLogs\cmstp.exe.log,\UsageLogs\cscript.exe.log,\UsageLogs\mshta.exe.log,\UsageLogs\msxsl.exe.log,\UsageLogs\regsvr32.exe.log,\UsageLogs\rundll32.exe.log,\UsageLogs\svchost.exe.log,\UsageLogs\wscript.exe.log,\UsageLogs\wmic.exe.log") AND (PARENTPROCESSNAME notendswith "\MsiExec.exe" OR PARENTPROCESSCOMMANDLINE notcontains " -Embedding" OR PROCESSNAME notendswith "\rundll32.exe" OR (COMMANDLINE notcontains "Temp" OR COMMANDLINE notcontains "zzzzInvokeManagedCustomActionOutOfProc")) select Action1.HOSTNAME,Action1.MESSAGE,Action1.USERNAME,Action1.DOMAIN,Action1.OBJECTNAME,Action1.FILENAME,Action1.PROCESSNAME
Detection
Execution Mode
realtime
Log Sources
Windows
Author
frack113, omkar72, oscd.community, Wojciech Lesicki
