Detect .NET runtime being loaded in JScript for code execution
This query detects .NET being loaded from wscript or cscript to run .NET code, such as cactustorch and sharpshooter. All based on the DotNetToJScript by James Foreshaw documented here…
Description
This query detects .NET being loaded from wscript or cscript to run .NET code, such as cactustorch and sharpshooter. All based on the DotNetToJScript by James Foreshaw documented here https://github.com/tyranid/DotNetToJScript.
Detection logic
Detection requirements
- Platform
- ContainersIaaSLinuxmacOSWindows
The rule states no platform. This is derived from the ATT&CK technique it maps to.
- Log source product
- microsoftthreatprotection
- Log source service
- deviceimageloadevents
MITRE ATT&CK mappings
0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.
No references are available for this detection.
From the source
- At source
- Open at source
- Upstream identifier
- 9f921513-65f3-48a2-ae7d-326c5901c55e
- Tagged by the source as
- Execution
Licence
- Published under
- MIT LicenseRead the licence
- Attribution
- Required
- Obtained under
- MITRead the origin licence
Authorship
- Published
- Sep 1, 2026
- Version
- 1