Sigma rule: Suspicious CLR Logs Creation

Rule

Title

Suspicious CLR Logs Creation

Status

deprecated

Level

high

Author

omkar72, oscd.community, Wojciech Lesicki

Date

2020/10/12

Modified

2023/01/05

File

deprecated/windows/file_event_win_susp_clr_logs.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects suspicious .NET assembly executions. Could detect using Cobalt Strike's command execute-assembly.

Log source

product

windows

category

file_event

definition

Check your sysmon configuration for monitoring UsageLogs folder. In SwiftOnSecurity configuration we have that thanks @SBousseaden

Detection

selection:
    TargetFilename|contains|all:
        - '\AppData\Local\Microsoft\CLR'
        - '\UsageLogs\'
    TargetFilename|contains:
        - 'mshta'
        - 'cscript'
        - 'wscript'
        - 'regsvr32'
        - 'wmic'
        - 'rundll32'
        - 'svchost'
condition: selection

False positives (as the rule lists them)

• Rundll32.exe with zzzzInvokeManagedCustomActionOutOfProc in command line and msiexec.exe as parent process - https://twitter.com/SBousseaden/status/1388064061087260675

Tags

• attack.execution
• attack.defense_evasion
• attack.t1059.001
• attack.t1218

MITRE ATT&CK ids this rule names

• T1059.001
• T1218

References

• https://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html
• https://bohops.com/2021/03/16/investigating-net-clr-usage-log-tampering-techniques-for-edr-evasion/
• https://github.com/olafhartong/sysmon-modular/blob/5e5f6d90819a7f35eec0aba08021d0d201bb9055/11_file_create/include_dotnet.xml

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/deprecated/windows/file_event_win_susp_clr_logs.yml