Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
72 detections
Filters
Last updated
All Time
Detection languages
36
19
7
5
2
Contributors
23
18
4
4
4
Categories
54
37
14
11
6
Platforms
72
3
Products / Services
30
27
16
5
2
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
IDS Classtypes
2
IDS Protocols
1
1
Prior to deploying Macaw ransomware in an organization, the adversary frequently uses MSBuild.exe as a LOLBin to communicate with the C2.
Description:.
The query looks for several different MITRE techniques, grouped by risk level.
A weighting is applied to each risk level and a total score calculated per machine.
Techniques can be added/removed as required.
The query looks for several different MITRE techniques, grouped by risk level.
A weighting is applied to each risk level and a total score calculated per machine.
Techniques can be added/removed as required.
Detects outbound network connections initiated by msbuild.exe to common C2 ports (80, 443), which could indicate the use of Silenttrinity or other MSBuild-based execution for command and control.
The following analytic detects the execution of msbuild.exe from a non-standard path. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that deviate from typical msbuild.exe locations. This activity is significant because msbuild.exe is commonly abused by attackers to execute malicious code, and running it from an unusual path can indicate an attempt to evade detection. If confirmed malicious, this behavior could allow an attacker to execute arbitrary code, potentially leading to system compromise and further malicious activities.
The following analytic detects the execution of renamed instances of msbuild.exe. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and original file names within the Endpoint data model. This activity is significant because msbuild.exe is a legitimate tool often abused by attackers to execute malicious code while evading detection. If confirmed malicious, this behavior could allow an attacker to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further lateral movement within the network.
This analytic identifies instances where `wmiprvse.exe` spawns `msbuild.exe`. This behavior is unusual and indicates potential misuse of a COM object or a Living Off The Land (LOLBAS) technique. `msbuild.exe` is typically spawned by `devenv.exe` during legitimate Visual Studio use, not by `wmiprvse.exe`. If confirmed malicious, this could indicate an attacker executing arbitrary code or scripts, potentially leading to system compromise or further malicious activities.
This analytic detects the suspicious spawning of MSBuild.exe by Windows Script Host processes (cscript.exe or wscript.exe). This behavior is often associated with malware or adversaries executing malicious MSBuild processes via scripts on compromised hosts. The detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process creation events where MSBuild is a child of script hosts. This activity is significant as it may indicate an attempt to execute malicious code, potentially leading to unauthorized code execution and further compromise.
Detects the creation of suspicious child processes by 'scrcons.exe' (Script Event Consumer). 'scrcons.exe' is a legitimate Windows component used for WMI event handling, but its spawning of common scripting interpreters, proxy execution binaries, or task schedulers can indicate malicious activity, often related to persistence or execution techniques leveraging WMI.
This rule detects the execution of 'MSBuild.exe' when its parent process is not one of the commonly associated legitimate processes such as 'devenv.exe', 'cmd.exe', 'msbuild.exe' itself, 'python.exe', 'explorer.exe', or 'nuget.exe'. This behavior can indicate an adversary abusing MSBuild for code execution or defense evasion.
Page 4 of 4