admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'ba-msbuild' of github.com:splunk/security_content into ba-msbuild

Browse Source
This commit is contained in:
Lou Stella
2022-03-03 16:06:04 -06:00
parent 6b4a9fe22c f18c6e587f
commit 7803594dfe
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml
+1 -1
View File
@@ -5,7 +5,7 @@ date: '2022-03-03'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
- Endpoint_Processes
description: This analytic is to detect a suspicious child process of MSBuild spawned
by Windows Script Host - cscript or wscript. This behavior or event are commonly
seen and used by malware or adversaries to execute malicious msbuild process using
detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml
+1 -1
View File
@@ -5,7 +5,7 @@ date: '2022-03-03'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
- Endpoint_Processes
description: The following analytic identifies wmiprvse.exe spawning msbuild.exe.
This behavior is indicative of a COM object being utilized to spawn msbuild from
wmiprvse.exe. It is common for MSBuild.exe to be spawned from devenv.exe while using