Detection rules › Splunk
Suspicious csc.exe Source File Folder (Sysmon)
Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as csc.exe or GCC/MinGW. This use case detects csc.exe executions compiling a .cs file from a suspicious folder. Note: Due to its extended logging capabilities on parent process information, Sysmon is recommended for best fidelity
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth | T1027.004 Obfuscated Files or Information: Compile After Delivery |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
Rule body yaml
id: '32674.58081'
title: Suspicious csc.exe Source File Folder
description: 'Adversaries may attempt to make payloads difficult to discover and analyze
by delivering files to victims as uncompiled code. Text-based source code files
may subvert analysis and scrutiny from protections targeting executables/binaries.
These payloads will need to be compiled before execution; typically via native utilities
such as csc.exe or GCC/MinGW. This use case detects csc.exe executions compiling
a .cs file from a suspicious folder. Note: Due to its extended logging capabilities
on parent process information, Sysmon is recommended for best fidelity. -- Threat
Actor Association: Alpha (STAC1248)'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
(TERM(csc) OR "csc.exe") ("\\AppData" OR "\\Windows\\Temp") | regex parent_process_path!="(?i)(^C:\x5cProgram\sFiles)|(sdiagnhost|w3wp|choco)\.exe"|
regex parent_process!="(?i)\x5cProgramData\x5cMicrosoft\x5cWindows\sDefender\sAdvanced\sThreat\sProtection"|
regex process="(?i)\x5cAppData\x5c|\x5cWindows\x5cTemp" | table _time, host, user,
process, process_*, parent_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:obfuscated files or information:compile after delivery
technique_id:
- T1027.004
data_category:
- Windows Sysmon
references:
- https://attack.mitre.org/techniques/T1027/004/
- https://github.com/SigmaHQ/sigma/blob/c0332a9d96f6c7804fcc85dd706caed889446a62/rules/windows/process_creation/proc_creation_win_csc_susp_folder.yml
- https://kostas-ts.medium.com/ursnif-vs-italy-il-pdf-del-destino-5c83d6281072
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<") (TERM(csc) OR "csc.exe") ("\\AppData" OR "\\Windows\\Temp")
Stage 2: regex
| regex parent_process_path!="(?i)(^C:\x5cProgram\sFiles)|(sdiagnhost|w3wp|choco)\.exe"
Stage 3: regex
| regex parent_process!="(?i)\x5cProgramData\x5cMicrosoft\x5cWindows\sDefender\sAdvanced\sThreat\sProtection"
Stage 4: regex
| regex process="(?i)\x5cAppData\x5c|\x5cWindows\x5cTemp"
Stage 5: table
| table _time, host, user, process, process_*, parent_*
Stage 6: bucket
| bin span=1s
Stage 7: stats
| stats values(*) as * by _time, host
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
parent_process_path | regex_match | "(?i)(^C:\x5cProgram\sFiles), (sdiagnhost|w3wp|choco).exe" |
parent_process | regex_match | "(?i)\x5cProgramData\x5cMicrosoft\x5cWindows\sDefender\sAdvanced\sThreat\sProtection" |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>1<" |
| 1 | TERM |
| 1 | csc |
| 1 | "csc.exe" |
| 1 | "\\AppData" |
| 1 | "\\Windows\\Temp" |