admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added detection testing service results inDetect renamed msbuild execution

Browse Source
This commit is contained in:
root
2021-01-19 21:42:57 +00:00
parent ad1564ceb7
commit b355147e2b
1 changed files with 11 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/suspicious_msbuild_rename.yml
+11 -9
View File
@@ -2,10 +2,10 @@ name: Suspicious msbuild rename
id: 4006adac-5937-11eb-ae93-0242ac130002
version: 1
date: '2021-01-12'
description: The following analytic identifies renamed instances of msbuild.exe executing.
Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and
C:\Windows\Microsoft.NET\Framework64\v4.0.30319. During investigation, identify the
code executed and what is executing a renamed instance of MSBuild.
description: The following analytic identifies renamed instances of msbuild.exe executing.
Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and
C:\Windows\Microsoft.NET\Framework64\v4.0.30319. During investigation, identify
the code executed and what is executing a renamed instance of MSBuild.
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -17,14 +17,15 @@ references:
- https://github.com/infosecn1nja/MaliciousMacroMSBuild/
author: Michael Haag, Splunk
search: '`sysmon` EventID=1 (OriginalFileName=msbuild.exe OR process_name=msbuild.exe)
| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine
| rename Computer as dest | `security_content_ctime(firstTime)`|
`security_content_ctime(lastTime)`| `suspicious_msbuild_rename_filter`'
| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
parent_process_name, process_name, OriginalFileName, process_path, CommandLine |
rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
`suspicious_msbuild_rename_filter`'
known_false_positives: Although unlikely, some legitimate applications may use a moved
copy of msbuild, triggering a false positive.
copy of msbuild, triggering a false positive.
tags:
analytics_story:
- 'Trusted developer utilities proxy execution msbuild'
- Trusted developer utilities proxy execution msbuild
mitre_attack_id:
- T1127.001, T1036.003
kill_chain_phases:
@@ -38,3 +39,4 @@ tags:
asset_type: Endpoint
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log
automated_detection_testing: passed