Elastic high stable eql

Potential Credential Access via Trusted Developer Utility

An instance of MSBuild, the Microsoft Build Engine, loaded DLLs (dynamically linked libraries) responsible for Windows credential management. This technique is sometimes used for credential dumping.

View Source

Detection Logic

sequence by process.entity_id
 [process where host.os.type == "windows" and event.type == "start" and (process.name : "MSBuild.exe" or process.pe.original_file_name == "MSBuild.exe")]
 [library where host.os.type == "windows" and dll.name : ("vaultcli.dll", "SAMLib.DLL")]

False Positives

  • ⚠ The Build Engine is commonly used by Windows developers but use by non-engineers is unusual.

Field Validations

Loading…

Comments (0)

Loading comments...