Detection rules › Splunk
Microsoft Build Engine Suspicious Parent Process (Sysmon)
Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads. There are many utilities used for software development related tasks that can be used to execute code in various forms to assist in development, debugging, and reverse engineering. These utilities may often be signed with legitimate certificates that allow them to execute on a system and proxy execution of malicious code through a trusted process that effectively bypasses application control solutions. This use case detects msbuild.exe spawned by a scripting interpreter (such as CMD, PowerShell, etc.).
MITRE ATT&CK coverage
References
- https://attack.mitre.org/techniques/T1127/
- https://attack.mitre.org/techniques/T1127/001/
- https://attack.mitre.org/techniques/T1059/
- https://attack.mitre.org/techniques/T1059/001/
- https://attack.mitre.org/techniques/T1059/003/
- https://attack.mitre.org/techniques/T1059/005/
- https://detection.fyi/elastic/detection-rules/windows/defense_evasion_execution_msbuild_started_by_script/?query=msbuild
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
Rule body yaml
id: '32492.57742'
title: Microsoft Build Engine Suspicious Parent Process
description: Adversaries may take advantage of trusted developer utilities to proxy
execution of malicious payloads. There are many utilities used for software development
related tasks that can be used to execute code in various forms to assist in development,
debugging, and reverse engineering. These utilities may often be signed with legitimate
certificates that allow them to execute on a system and proxy execution of malicious
code through a trusted process that effectively bypasses application control solutions.
This use case detects msbuild.exe spawned by a scripting interpreter (such as CMD,
PowerShell, etc.).
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
("msbuild.exe" OR TERM(msbuild)) ("cmd.exe" OR "powershell.exe" OR "pwsh.exe" OR
"powershell_ise.exe" OR "cscript.exe" OR "wscript.exe" OR "mshta.exe") | regex process_name="(?i)msbuild\.exe"|
regex parent_process_name="(?i)(cmd|powershell(_ise)?|pwsh|cscript|wscript|mshta)\.exe"
| table _time, host, user, process, process_*, parent_* | bin span=1s | stats values(*)
as * by _time, host '
techniques:
- execution:command and scripting interpreter:powershell
- defense-evasion:trusted developer utilities proxy execution:msbuild
- execution:command and scripting interpreter
- defense-evasion:trusted developer utilities proxy execution
- execution:command and scripting interpreter:visual basic
- execution:command and scripting interpreter:windows command shell
technique_id:
- T1059.001
- T1127.001
- T1059
- T1127
- T1059.005
- T1059.003
data_category:
- Windows Sysmon
references:
- https://attack.mitre.org/techniques/T1127/
- https://attack.mitre.org/techniques/T1127/001/
- https://attack.mitre.org/techniques/T1059/
- https://attack.mitre.org/techniques/T1059/001/
- https://attack.mitre.org/techniques/T1059/003/
- https://attack.mitre.org/techniques/T1059/005/
- https://detection.fyi/elastic/detection-rules/windows/defense_evasion_execution_msbuild_started_by_script/?query=msbuild
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<") ("msbuild.exe" OR TERM(msbuild)) ("cmd.exe" OR "powershell.exe" OR "pwsh.exe" OR "powershell_ise.exe" OR "cscript.exe" OR "wscript.exe" OR "mshta.exe")
Stage 2: regex
| regex process_name="(?i)msbuild\.exe"
Stage 3: regex
| regex parent_process_name="(?i)(cmd|powershell(_ise)?|pwsh|cscript|wscript|mshta)\.exe"
Stage 4: table
| table _time, host, user, process, process_*, parent_*
Stage 5: bucket
| bin span=1s
Stage 6: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
parent_process_name | regex_match |
|
process_name | regex_match |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>1<" |
| 1 | "msbuild.exe" |
| 1 | TERM |
| 1 | msbuild |
| 1 | "cmd.exe" |
| 1 | "powershell.exe" |
| 1 | "pwsh.exe" |
| 1 | "powershell_ise.exe" |
| 1 | "cscript.exe" |
| 1 | "wscript.exe" |
| 1 | "mshta.exe" |