Techniques
Sample rules
Suspicious DotNET CLR Usage Log Artifact
- source: sigma
- technicques:
- t1218
Description
Detects the creation of Usage Log files by the CLR (clr.dll). These files are named after the executing process once the assembly is finished executing for the first time in the (user) session context.
Detection logic
condition: selection and not 1 of filter_main_*
filter_main_rundll32:
CommandLine|contains|all:
- Temp
- zzzzInvokeManagedCustomActionOutOfProc
Image|endswith: \rundll32.exe
ParentCommandLine|contains: ' -Embedding'
ParentImage|endswith: \MsiExec.exe
selection:
TargetFilename|endswith:
- \UsageLogs\cmstp.exe.log
- \UsageLogs\cscript.exe.log
- \UsageLogs\mshta.exe.log
- \UsageLogs\msxsl.exe.log
- \UsageLogs\regsvr32.exe.log
- \UsageLogs\rundll32.exe.log
- \UsageLogs\svchost.exe.log
- \UsageLogs\wscript.exe.log
- \UsageLogs\wmic.exe.log