Detection rules › Splunk
Suspicious csc.exe Source File Folder (Windows Event Log)
Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as csc.exe or GCC/MinGW. This use case detects csc.exe executions compiling a .cs file from a suspicious folder. Note: Due to its extended logging capabilities on parent process information, Sysmon is recommended for best fidelity
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth | T1027.004 Obfuscated Files or Information: Compile After Delivery |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4688 | A new process has been created. |
Rule body yaml
id: '32674.58080'
title: Suspicious csc.exe Source File Folder
description: 'Adversaries may attempt to make payloads difficult to discover and analyze
by delivering files to victims as uncompiled code. Text-based source code files
may subvert analysis and scrutiny from protections targeting executables/binaries.
These payloads will need to be compiled before execution; typically via native utilities
such as csc.exe or GCC/MinGW. This use case detects csc.exe executions compiling
a .cs file from a suspicious folder. Note: Due to its extended logging capabilities
on parent process information, Sysmon is recommended for best fidelity. -- Threat
Actor Association: Alpha (STAC1248)'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
"<EventID>4688<" OR Type=Process) (TERM(csc) OR "csc.exe") ("\\AppData" OR "\\Windows\\Temp")
| regex parent_process_path!="(?i)(^C:\x5cProgram\sFiles)|(sdiagnhost|w3wp|choco)\.exe"|
regex process="(?i)\x5cAppData\x5c|\x5cWindows\x5cTemp"| regex process!="(?i)\"C:\x5cWindows\x5cMicrosoft\.NET\x5cFramework64\x5cv\d+\.\d+\.\d+\x5ccsc\.exe\"\s\/noconfig\s\/fullpaths\s@\"C:\x5cWINDOWS\x5cTEMP\x5c[a-zA-Z0-9]{8}\x5c[a-zA-Z0-9]{8}\.cmdline\""
| table _time, host, user, process, process_*, parent_* | bin span=1s | stats values(*)
as * by _time, host '
techniques:
- defense-evasion:obfuscated files or information:compile after delivery
technique_id:
- T1027.004
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://attack.mitre.org/techniques/T1027/004/
- https://github.com/SigmaHQ/sigma/blob/c0332a9d96f6c7804fcc85dd706caed889446a62/rules/windows/process_creation/proc_creation_win_csc_susp_folder.yml
- https://kostas-ts.medium.com/ursnif-vs-italy-il-pdf-del-destino-5c83d6281072
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process) (TERM(csc) OR "csc.exe") ("\\AppData" OR "\\Windows\\Temp")
Stage 2: regex
| regex parent_process_path!="(?i)(^C:\x5cProgram\sFiles)|(sdiagnhost|w3wp|choco)\.exe"
Stage 3: regex
| regex process="(?i)\x5cAppData\x5c|\x5cWindows\x5cTemp"
Stage 4: regex
| regex process!="(?i)\"C:\x5cWindows\x5cMicrosoft\.NET\x5cFramework64\x5cv\d+\.\d+\.\d+\x5ccsc\.exe\"\s\/noconfig\s\/fullpaths\s@\"C:\x5cWINDOWS\x5cTEMP\x5c[a-zA-Z0-9]{8}\x5c[a-zA-Z0-9]{8}\.cmdline\""
Stage 5: table
| table _time, host, user, process, process_*, parent_*
Stage 6: bucket
| bin span=1s
Stage 7: stats
| stats values(*) as * by _time, host
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
parent_process_path | regex_match | "(?i)(^C:\x5cProgram\sFiles), (sdiagnhost|w3wp|choco).exe" |
process | regex_match | "(?i)\"C:\x5cWindows\x5cMicrosoft.NET\x5cFramework64\x5cv\d+.\d+.\d+\x5ccsc.exe\"\s\/noconfig\s\/fullpaths\s@\"C:\x5cWINDOWS\x5cTEMP\x5c[a-zA-Z0-9]{8}\x5c[a-zA-Z0-9]{8}.cmdline\"" |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>4688<" |
| 1 | TERM |
| 1 | csc |
| 1 | "csc.exe" |
| 1 | "\\AppData" |
| 1 | "\\Windows\\Temp" |