Potential MOVEit Transfer CVE-2023-34362 Exploitation - Dynamic Compilation Via Csc.EXE

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: @kostastsale
Source: github.com/SigmaHQ/sigma

Detects the execution of "csc.exe" via "w3wp.exe" process. MOVEit affected hosts execute "csc.exe" via the "w3wp.exe" process to dynamically compile malicious DLL files. MOVEit is affected by a critical vulnerability. Exploited hosts show evidence of dynamically compiling a DLL and writing it under C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\root\([a-z0-9]{5,12})\([a-z0-9]{5,12})\App_Web_[a-z0-9]{5,12}.dll. Hunting Opportunity Events from IIS dynamically compiling binaries via the csc.exe on behalf of the MOVEit application, especially since May 27th should be investigated.

Known false positives

Initial software installation and software updates.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059` Command and Scripting Interpreter

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Potential MOVEit Transfer CVE-2023-34362 Exploitation - Dynamic Compilation Via Csc.EXE
id: 39ac1fb0-07f1-474b-b97e-c5c0eace0d79
status: test
description: |
    Detects the execution of "csc.exe" via "w3wp.exe" process. MOVEit affected hosts execute "csc.exe" via the "w3wp.exe" process to dynamically compile malicious DLL files.

    MOVEit is affected by a critical vulnerability. Exploited hosts show evidence of dynamically compiling a DLL and writing it under C:\\Windows\\Microsoft\.NET\\Framework64\\v4\.0\.30319\\Temporary ASP\.NET Files\\root\\([a-z0-9]{5,12})\\([a-z0-9]{5,12})\\App_Web_[a-z0-9]{5,12}\.dll.

    Hunting Opportunity

    Events from IIS dynamically compiling binaries via the csc.exe on behalf of the MOVEit application, especially since May 27th should be investigated.
references:
    - https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response
    - https://www.trustedsec.com/blog/critical-vulnerability-in-progress-moveit-transfer-technical-analysis-and-recommendations/
author: '@kostastsale'
date: 2023-06-01
tags:
    - attack.execution
    - attack.t1059
    - cve.2023-34362
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\w3wp.exe'
        ParentCommandLine|contains: 'moveitdmz pool'
        Image|endswith: '\csc.exe'
    condition: selection
falsepositives:
    - Initial software installation and software updates.
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    ParentImage|endswith: '\w3wp.exe'
    ParentCommandLine|contains: 'moveitdmz pool'
    Image|endswith: '\csc.exe'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`\csc.exe` corpus 9 (sigma 9)	`field:"Image" kind:ends_with value:"\csc.exe"`
`ParentCommandLine`	match	`moveitdmz pool`	`field:"ParentCommandLine" kind:match value:"moveitdmz pool"`
`ParentImage`	ends_with	`\w3wp.exe` corpus 12 (sigma 12)	`field:"ParentImage" kind:ends_with value:"\w3wp.exe"`