Suspicious csc.exe Source File Folder (Windows Event Log)

id: '32674.58080'
title: Suspicious csc.exe Source File Folder
description: 'Adversaries may attempt to make payloads difficult to discover and analyze
  by delivering files to victims as uncompiled code. Text-based source code files
  may subvert analysis and scrutiny from protections targeting executables/binaries.
  These payloads will need to be compiled before execution; typically via native utilities
  such as csc.exe or GCC/MinGW. This use case detects csc.exe executions compiling
  a .cs file from a suspicious folder. Note: Due to its extended logging capabilities
  on parent process information, Sysmon is recommended for best fidelity. -- Threat
  Actor Association: Alpha (STAC1248)'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(csc) OR "csc.exe") ("\\AppData" OR "\\Windows\\Temp")
  | regex parent_process_path!="(?i)(^C:\x5cProgram\sFiles)|(sdiagnhost|w3wp|choco)\.exe"|
  regex process="(?i)\x5cAppData\x5c|\x5cWindows\x5cTemp"| regex process!="(?i)\"C:\x5cWindows\x5cMicrosoft\.NET\x5cFramework64\x5cv\d+\.\d+\.\d+\x5ccsc\.exe\"\s\/noconfig\s\/fullpaths\s@\"C:\x5cWINDOWS\x5cTEMP\x5c[a-zA-Z0-9]{8}\x5c[a-zA-Z0-9]{8}\.cmdline\""
  | table _time, host, user, process, process_*, parent_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- defense-evasion:obfuscated files or information:compile after delivery
technique_id:
- T1027.004
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://attack.mitre.org/techniques/T1027/004/
- https://github.com/SigmaHQ/sigma/blob/c0332a9d96f6c7804fcc85dd706caed889446a62/rules/windows/process_creation/proc_creation_win_csc_susp_folder.yml
- https://kostas-ts.medium.com/ursnif-vs-italy-il-pdf-del-destino-5c83d6281072