CyberArkEPM - MSBuild usage as LOLBin

Severity: medium
Time window: 30m
Source: github.com/Azure/Azure-Sentinel

'Detects usage of msbuild tool as LOLBin.'

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1127` Trusted Developer Utilities Proxy Execution

Rule body

id: a11bf869-458e-49fd-be03-58021b14be15
name: CyberArkEPM - MSBuild usage as LOLBin
description: |
  'Detects usage of msbuild tool as LOLBin.'
severity: Medium
requiredDataConnectors:
  - connectorId: CyberArkEPM
    dataTypes:
      - CyberArkEPM
queryFrequency: 30m
queryPeriod: 30m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - DefenseEvasion
relevantTechniques:
  - T1127
query: | 
  CyberArkEPM
  | where EventSubType != 'AttackAttempt'
  | where ActingProcessName endswith @'msbuild.exe'
  | where ActingProcessCommandLine has_any ('xml', 'csproj', 'vcxproj', 'vbproj', 'fsproj')
  | extend AccountCustomEntity = ActorUsername
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountCustomEntity
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

CyberArkEPM

Stage 2: `where`

| where EventSubType != 'AttackAttempt'

Stage 3: `where`

| where ActingProcessName endswith @'msbuild.exe'

Stage 4: `where`

| where ActingProcessCommandLine has_any ('xml', 'csproj', 'vcxproj', 'vbproj', 'fsproj')

Stage 5: `extend`

| extend AccountCustomEntity = ActorUsername

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ActingProcessCommandLine`	match	`csproj` transforms: `term` `fsproj` transforms: `term` `vbproj` transforms: `term` `vcxproj` transforms: `term` `xml` transforms: `term`	`field:"ParentCommandLine" kind:match`
`ActingProcessName`	ends_with	`msbuild.exe`	`field:"ParentImage" kind:ends_with value:"msbuild.exe"`
`EventSubType`	ne	`AttackAttempt`	`field:"EventSubType" kind:ne value:"AttackAttempt"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AccountCustomEntity`	`extend`

CyberArkEPM - MSBuild usage as LOLBin

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: where

Stage 5: extend

Indicators

Output fields

Stage 1: `source`

Stage 2: `where`

Stage 3: `where`

Stage 4: `where`

Stage 5: `extend`