Elastic Defend high stable eql

MSBuild with Unusual Arguments

Identifies the execution of the built-in MSBuild utility with a suspicious count of command line arguments (less than three). Adversaries may use MSBuild to proxy the execution of malicious code via a trusted Windows utility.

View Source

Detection Logic

process where event.action == "start" and
 process.pe.original_file_name == "MSBuild.exe" and process.args_count == 2 and
  /* FP - expected developers msbuild installation directories */

 not process.executable : ("?:\\Program Files (x86)\\Microsoft Visual Studio\\*",
                           "?:\\Program Files\\Microsoft Visual Studio\\*",
                           "?:\\Program Files (x86)\\MSBuild\\*",
                           "?:\\Program Files\\MSBuild\\*") and
 not process.command_line : ("* /*", "* .\\*", "*.proj*", "*.sln*") and
  /* FP - Third Party Programs except MS Office */

 not (process.parent.executable : ("?:\\Program Files (x86)\\*.exe", "?:\\Program Files\\*.exe") and
       not process.parent.name : 
                          ("winword.exe",
                           "excel.exe",
                           "outlook.exe",
                           "powerpnt.exe",
                           "eqnedt32.exe",
                           "fltldr.exe",
                           "mspub.exe",
                           "msaccess.exe"))

Field Validations

Loading…

Comments (0)

Loading comments...