DotNet CLR DLL Loaded By Scripting Applications (4508a70e-97ef-4300-b62b-ff27992990ea)
Detects .NET CLR DLLs being loaded by scripting applications such as wscript or cscript. This could be an indication of potential suspicious execution.
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| Process Injection - T1055 (43e7dc91-05b2-474c-b9ac-2ed4fe101f4d) | Attack Pattern | DotNet CLR DLL Loaded By Scripting Applications (4508a70e-97ef-4300-b62b-ff27992990ea) | Sigma-Rules | 1 |