Query: detection rule: Detects .NET CLR DLLs being loaded by scripting applications such as wscript or cscript. This could be an indication of
Matching passage: Sigma rule: Detects .NET CLR DLLs being loaded by scripting applications such as wscript or cscript. This could be an indication of. Logsource: windows / image_load. Rule: title: DotNet CLR DLL Loaded By Scripting Applications id: 4508a70e-97ef-4300-b62b-ff27992990ea status: test description: Detects .NET CLR DLLs being loaded by scripting applications such as wscript or cscript. This could be an indication of potential suspicious execution. references: - https://github.com/tyranid/DotNetToJScript - https://thewover.github.io/Introducing-Donut/ - https://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html - https://web.archive.org/web/20221026202428/https://gist.github.com/code-scrap/d7f152ffcdb3e0b02f7f394f5187f008 author: omkar72, oscd.community date: 2020-10-14 modified: 2023-02-23 tags: - attack.execution - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: category: image_load product: windows detection: selection: Image|endswith: - \cmstp.exe - \cscript.exe - \mshta.exe - \msxsl.exe - \regsvr32.exe - \wmic.exe - \wscript.exe ImageLoaded|endswith: - \clr.dll - \mscoree.dll - \mscorlib.dll condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the use of curl with NTLM authentication and empty credentials (-u :), which can be abused to leak the currently. Logsource: windows / process_creation. Rule: title: NTLM Hash Leak Via Curl NTLM Authentication id: 916eb839-895e-47f8-99ee-3008bf377a3e status: test description: 'Detects the use of curl with NTLM authentication and empty credentials (-u :), which can be abused to leak the currently logged-in user''s NTLMv2 challenge-response to an attacker-controlled server, enabling offline cracking or relay attacks. When no credentials are provided, the Microsoft-shipped curl passes a NULL identity to Windows SSPI, which automatically falls back to the current user''s logon session credentials stored in LSASS — without requiring a plaintext password. This behavior is exclusive to the curl binary shipped by Microsoft (available since Windows 10 / Windows Server 2019), which is built with SSPI support. ' references: - https://github.com/curl/curl/blob/master/lib/vauth/ntlm_sspi.c#L128-L140 - https://learn.microsoft.com/en-us/windows/win32/secauthn/acquirecredentialshandle--ntlm - https://curl.se/docs/manpage.html#--ntlm author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-06-04 tags: - attack.credential-access - attack.t1187 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \curl.exe - OriginalFileName: curl.exe selection_ntlm_flag: CommandLine|contains: --ntlm selection_empty_creds: CommandLine|re: '(?i)\s(-u|--user)\s*:' condition: all of selection_* falsepositives: - Should be very rare as it's not widely known or used, but could occur in legitimate use cases where curl is used with NTLM authentication and empty credentials, such as in certain scripts or automation tasks. level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_ntlm_hash_leak_attempt/info.yml