Detect .NET runtime being loaded in JScript for code execution

Status: available
Severity: medium
Time window: 1h
Source: github.com/Azure/Azure-Sentinel

This query detects .NET being loaded from wscript or cscript to run .NET code, such as cactustorch and sharpshooter. All based on the DotNetToJScript by James Foreshaw documented here https://github.com/tyranid/DotNetToJScript.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1204` User Execution

Telemetry coverage

Platform	Record / event type
Microsoft Defender for Endpoint	`DeviceImageLoadEvents` action `any`: Image load

Rule body

id: 9f921513-65f3-48a2-ae7d-326c5901c55e
name: Detect .NET runtime being loaded in JScript for code execution
description: |
  This query detects .NET being loaded from wscript or cscript to run .NET code, such as cactustorch and sharpshooter.
  All based on the DotNetToJScript by James Foreshaw documented here https://github.com/tyranid/DotNetToJScript. 
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - DeviceImageLoadEvents
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Execution
relevantTechniques:
  - T1204
query: |
  DeviceImageLoadEvents 
  | where FileName in~ ("mscoree.dll", "mscorlib.dll", "mscorlib.ni.dll") 
  | where tolower(InitiatingProcessFileName) in ("wscript.exe", "cscript.exe", "mshta.exe")
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Sid
        columnName: InitiatingProcessAccountSid 
      - identifier: Name
        columnName: InitiatingProcessAccountName
      - identifier: NTDomain
        columnName: InitiatingProcessAccountDomain
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: DeviceName
  - entityType: Process
    fieldMappings:
      - identifier: CommandLine
        columnName: InitiatingProcessCommandLine
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

DeviceImageLoadEvents

Stage 2: `where`

| where FileName in~ ("mscoree.dll", "mscorlib.dll", "mscorlib.ni.dll")

Stage 3: `where`

| where tolower(InitiatingProcessFileName) in ("wscript.exe", "cscript.exe", "mshta.exe")

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`FileName`	in	`mscoree.dll` `mscorlib.dll` `mscorlib.ni.dll`	`field:"file_name" kind:in`
`InitiatingProcessFileName`	in	`cscript.exe` transforms: `tolower` corpus 16 (elastic 15, splunk 1) `mshta.exe` transforms: `tolower` corpus 24 (elastic 22, splunk 2) `wscript.exe` transforms: `tolower` corpus 24 (elastic 23, splunk 1)	`field:"parent_process_name" kind:in`