Elastic medium stable eql

Microsoft Build Engine Started by a System Process

An instance of MSBuild, the Microsoft Build Engine, was started by Explorer or the WMI (Windows Management Instrumentation) subsystem. This behavior is unusual and is sometimes used by malicious payloads.

View Source

Detection Logic

process where host.os.type == "windows" and event.type == "start" and
  process.name : "MSBuild.exe" and
  process.parent.name : ("explorer.exe", "wmiprvse.exe")

False Positives

  • ⚠ The Build Engine is commonly used by Windows developers but use by non-engineers is unusual.

Field Validations

Loading…

Comments (0)

Loading comments...