detection.wiki

Detection rules › Kusto

Detect .NET runtime being loaded in JScript for code execution

Status
available
Severity
medium
Time window
1h
Source
github.com/Azure/Azure-Sentinel

This query detects .NET being loaded from wscript or cscript to run .NET code, such as cactustorch and sharpshooter. All based on the DotNetToJScript by James Foreshaw documented here https://github.com/tyranid/DotNetToJScript.

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1204 User Execution

Event coverage

ProviderEvent/ActionTypeTitle
SysmonEvent ID 7Image loaded
Defender-DeviceImageLoadEventsanyImage load (any)

Rule body kusto

id: 9f921513-65f3-48a2-ae7d-326c5901c55e
name: Detect .NET runtime being loaded in JScript for code execution
description: |
  This query detects .NET being loaded from wscript or cscript to run .NET code, such as cactustorch and sharpshooter.
  All based on the DotNetToJScript by James Foreshaw documented here https://github.com/tyranid/DotNetToJScript. 
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - DeviceImageLoadEvents
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Execution
relevantTechniques:
  - T1204
query: |
  DeviceImageLoadEvents 
  | where FileName in~ ("mscoree.dll", "mscorlib.dll", "mscorlib.ni.dll") 
  | where tolower(InitiatingProcessFileName) in ("wscript.exe", "cscript.exe", "mshta.exe")
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Sid
        columnName: InitiatingProcessAccountSid 
      - identifier: Name
        columnName: InitiatingProcessAccountName
      - identifier: NTDomain
        columnName: InitiatingProcessAccountDomain
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: DeviceName
  - entityType: Process
    fieldMappings:
      - identifier: CommandLine
        columnName: InitiatingProcessCommandLine
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: source

DeviceImageLoadEvents

Stage 2: where

| where FileName in~ ("mscoree.dll", "mscorlib.dll", "mscorlib.ni.dll")

Stage 3: where

| where tolower(InitiatingProcessFileName) in ("wscript.exe", "cscript.exe", "mshta.exe")

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
FileNamein
  • mscoree.dll
  • mscorlib.dll
  • mscorlib.ni.dll
InitiatingProcessFileNamein
  • cscript.exe transforms: tolower, cased corpus 7 (elastic 6, splunk 1)
  • mshta.exe transforms: tolower, cased corpus 12 (elastic 10, splunk 2)
  • wscript.exe transforms: tolower, cased corpus 11 (elastic 10, splunk 1)