Common Language Runtime Loaded via an Unsigned Module

sequence by process.entity_id with maxspan=1m
 [library where
  dll.Ext.relative_file_creation_time <= 300 and
  dll.code_signature.trusted  != true and not startswith~(dll.name, process.name) and
  dll.hash.sha256 : "??*" and dll.path : "?*" and
  (process.code_signature.subject_name : "Microsoft*" or process.code_signature.exists == false) and
  not dll.code_signature.status : ("trusted", "errorCode_endpoint*") and
  not process.executable : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*", "?:\\Windows\\System32\\DriverStore\\FileRepository\\*") and
  not dll.path : ("?:\\Windows\\assembly\\NativeImages_v*",
                  "?:\\Windows\\System32\\DriverStore\\FileRepository\\*",
                  "?:\\Windows\\SoftwareDistribution\\Download\\*",
                  "?:\\Windows\\WinSxS\\*",
                  "?:\\Program Files\\*",
                  "?:\\Program Files (x86)\\*") and
  not dll.hash.sha256 : "f51ff500ace815d2d2213fe961a2080f8b7da98474d7a7736a49961938e1028e"] as event0
 [library where dll.name : "clr.dll" and
  stringcontains~(process.thread.Ext.call_stack_summary, concat("mscoreei.dll
| ", event0.dll.name)) and
  not process.thread.Ext.call_stack_summary : "*mscoreei.dll
| msi*.tmp
| msi.dll*"]