Sigma rule: Suspicious DotNET CLR Usage Log Artifact

Rule

Title

Suspicious DotNET CLR Usage Log Artifact

Status

test

Level

high

Author

frack113, omkar72, oscd.community, Wojciech Lesicki

Date

2022-11-18

Modified

2023-02-23

File

rules/windows/file/file_event/file_event_win_net_cli_artefact.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the creation of Usage Log files by the CLR (clr.dll). These files are named after the executing process once the assembly is finished executing for the first time in the (user) session context.

Log source

product

windows

category

file_event

definition

Requirements: UsageLogs folder must be monitored by the sysmon configuration

Detection

selection:
    TargetFilename|endswith:
        - '\UsageLogs\cmstp.exe.log'
        - '\UsageLogs\cscript.exe.log'
        - '\UsageLogs\mshta.exe.log'
        - '\UsageLogs\msxsl.exe.log'
        - '\UsageLogs\regsvr32.exe.log'
        - '\UsageLogs\rundll32.exe.log'
        - '\UsageLogs\svchost.exe.log'
        - '\UsageLogs\wscript.exe.log'
        - '\UsageLogs\wmic.exe.log'
filter_main_rundll32:
    # This filter requires the event to be enriched by additional information such as ParentImage and CommandLine activity
    ParentImage|endswith: '\MsiExec.exe'
    ParentCommandLine|contains: ' -Embedding'
    Image|endswith: '\rundll32.exe'
    CommandLine|contains|all:
        - 'Temp'
        - 'zzzzInvokeManagedCustomActionOutOfProc'
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Rundll32.exe with zzzzInvokeManagedCustomActionOutOfProc in command line and msiexec.exe as parent process - https://twitter.com/SBousseaden/status/1388064061087260675

Tags

• attack.stealth
• attack.t1218

MITRE ATT&CK ids this rule names

• T1218

Related rules

• 4508a70e-97ef-4300-b62b-ff27992990ea (derived)
• e4b63079-6198-405c-abd7-3fe8b0ce3263 (obsolete)

References

• https://bohops.com/2021/03/16/investigating-net-clr-usage-log-tampering-techniques-for-edr-evasion/
• https://github.com/olafhartong/sysmon-modular/blob/fa1ae53132403d262be2bbd7f17ceea7e15e8c78/11_file_create/include_dotnet.xml
• https://web.archive.org/web/20221026202428/https://gist.github.com/code-scrap/d7f152ffcdb3e0b02f7f394f5187f008
• https://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/file/file_event/file_event_win_net_cli_artefact.yml