Elastic low stable eql

Microsoft Build Engine Using an Alternate Name

An instance of MSBuild, the Microsoft Build Engine, was started after being renamed. This is uncommon behavior and may indicate an attempt to run unnoticed or undetected.

View Source

Detection Logic

process where host.os.type == "windows" and event.type == "start" and
  process.pe.original_file_name == "MSBuild.exe" and
  not process.name : "MSBuild.exe"

False Positives

  • ⚠ The Build Engine is commonly used by Windows developers but use by non-engineers is unusual.

Field Validations

Loading…

Comments (0)

Loading comments...