name: MSBuild Suspicious Spawned By Script Process
id: 213b3148-24ea-11ec-93a2-acde48001122
version: 1
date: '2021-10-04'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
description: This analytic is to detect a suspicious child process of MSBuild spawned
  by Windows Script Host - cscript or wscript. This behavior or event are commonly
  seen and used by malware or adversaries to execute malicious msbuild process using
  malicious script in the compromised host. During triage, review parallel processes
  and identify any file modifications. MSBuild may load a script from the same path
  without having command-line arguments.
search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
  as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
  IN ("wscript.exe", "cscript.exe") AND `process_msbuild` by Processes.dest Processes.parent_process
  Processes.parent_process_name Processes.process_name Processes.original_file_name
  Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)` | `msbuild_suspicious_spawned_by_script_process_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
  endpoint product.
known_false_positives: False positives should be limited as developers do not spawn
  MSBuild via a WSH.
references:
- https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/
tags:
  analytic_story:
  - Trusted Developer Utilities Proxy Execution MSBuild
  confidence: 70
  context:
  - Stage:Execution
  - Stage:Defense Evasion
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/regsvr32_silent/sysmon.log
  impact: 70
  kill_chain_phases:
  - Exploitation
  message: Msbuild.exe process spawned by $parent_process_name$ on $dest$ executed
    by $user$
  mitre_attack_id:
  - T1127.001
  - T1127
  observable:
  - name: dest
    type: Endpoint
    role:
    - Victim
  - name: User
    type: User
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Processes.dest
  - Processes.parent_process
  - Processes.parent_process_name
  - Processes.process_name
  - Processes.original_file_name
  - Processes.user
  risk_score: 49
  security_domain: endpoint
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint