name: Suspicious microsoft workflow compiler rename
id: f0db4464-55d9-11eb-ae93-0242ac130002
version: 1
date: '2021-01-12'
author: Michael Haag, Splunk
type: batch
datamodel: []
description: The following analytic identifies a renamed instance of microsoft.workflow.compiler.exe.
  Microsoft.workflow.compiler.exe is natively found in C:\Windows\Microsoft.NET\Framework64\v4.0.30319
  and is rarely utilized. When investigating, identify the executed code on disk and
  review. A spawned child process from microsoft.workflow.compiler.exe is uncommon.
  In any instance, microsoft.workflow.compiler.exe spawning from an Office product
  or any living off the land binary is highly suspect.
search: '`sysmon` EventID=1 (OriginalFileName=microsoft.workflow.compiler.exe OR process_name=microsoft.workflow.compiler.exe)
  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
  parent_process_name, process_name, OriginalFileName, process_path, CommandLine |
  rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
  `suspicious_microsoft_workflow_compiler_rename_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
  logs with the process name, parent process, and command-line executions from your
  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
  Sysmon TA.
known_false_positives: Although unlikely, some legitimate applications may use a moved
  copy of microsoft.workflow.compiler.exe, triggering a false positive.
references:
- https://lolbas-project.github.io/lolbas/Binaries/Microsoft.Workflow.Compiler/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-6---microsoftworkflowcompilerexe-payload-execution
tags:
  analytic_story:
  - Trusted Developer Utilities Proxy Execution
  - Cobalt Strike
  asset_type: Endpoint
  automated_detection_testing: passed
  cis20:
  - CIS 8
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/windows-sysmon.log
  kill_chain_phases:
  - Exploitation
  mitre_attack_id:
  - T1127, T1036.003
  nist:
  - PR.PT
  - DE.CM
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - EventID
  - OriginalFileName
  - process_name
  - Computer
  - User
  - parent_process_name
  - process_path
  - CommandLine
  security_domain: endpoint
