Managed .NET Code Execution via Windows Script Interpreter

sequence by process.entity_id with maxspan=2m
 [process where event.type == "start" and
  process.name : ("wscript.exe", "cscript.exe", "mshta.exe", "wmic.exe", "cmstp.exe", "msxsl.exe") and

  /* Only FPs observed so far, similar FPs can be handled via user custom applied exclusions */
  not (process.name : "mshta.exe" and process.parent.name : "Explorer.exe" and
       process.working_directory : "H:\\Code\\SignatureGen\\") and
  not (process.name : "wscript.exe" and process.parent.name : "wscript.exe" and
       process.parent.args : "/ChangedHostBitness" and process.parent.args : "/ALL")]
 [file where event.action == "creation" and
  file.path : "?:\\Users\\*\\Microsoft\\CLR_*\\UsageLogs\\*.exe.log" and
  /*
   CLR Usage Logs are created only for the first time
   the program executes .NET which should reduce noise compared to clr.dll imageload
  */
  file.name : ("wscript.exe.log",
               "cscript.exe.log",
               "mshta.exe.log",
               "wmic.exe.log",
               "cmstp.exe.log",
               "msxsl.exe.log")]