mscoree.dll
Microsoft .NET Runtime Execution Engine file version info
Library on Windows 2 known copies with hashes 3 Sigma rules name it
Is it the real mscoree.dll?
C:\Windows\system32\C:\Windows\SysWOW64\2 known copies
10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\mscoree.dll · signed by Microsoft Windows
57efa31b9f0116e46ab5e46c2e1764a79c507f751995db2e1c8727bdceb0c57610.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\mscoree.dll · signed by Microsoft Windows
8828de042d008783ba5b31c82935a3ed38d5996927c3399b3e1fc6fe723fc84eFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
What detects it
Sigma names mscoree.dll in 3 rules, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.