Microsoft Build Engine Started by a Script Process

  1[metadata]
  2creation_date = "2020/03/25"
  3integration = ["endpoint", "windows"]
  4maturity = "production"
  5updated_date = "2024/10/28"
  6min_stack_version = "8.14.0"
  7min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
  8
  9[rule]
 10author = ["Elastic"]
 11description = """
 12An instance of MSBuild, the Microsoft Build Engine, was started by a script or the Windows command interpreter. This
 13behavior is unusual and is sometimes used by malicious payloads.
 14"""
 15false_positives = ["The Build Engine is commonly used by Windows developers but use by non-engineers is unusual."]
 16from = "now-9m"
 17index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*"]
 18language = "kuery"
 19license = "Elastic License v2"
 20name = "Microsoft Build Engine Started by a Script Process"
 21risk_score = 21
 22rule_id = "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae2"
 23setup = """## Setup
 24
 25If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
 26events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
 27Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
 28`event.ingested` to @timestamp.
 29For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
 30"""
 31severity = "low"
 32tags = [
 33    "Domain: Endpoint",
 34    "OS: Windows",
 35    "Use Case: Threat Detection",
 36    "Tactic: Defense Evasion",
 37    "Tactic: Execution",
 38    "Data Source: Elastic Defend",
 39]
 40timestamp_override = "event.ingested"
 41type = "new_terms"
 42
 43query = '''
 44host.os.type:windows and event.category:process and event.type:start and (
 45  process.name.caseless:"msbuild.exe" or process.pe.original_file_name:"MSBuild.exe") and 
 46  process.parent.name:("cmd.exe" or "powershell.exe" or "pwsh.exe" or "powershell_ise.exe" or "cscript.exe" or
 47    "wscript.exe" or "mshta.exe")
 48'''
 49
 50
 51[[rule.threat]]
 52framework = "MITRE ATT&CK"
 53[[rule.threat.technique]]
 54id = "T1127"
 55name = "Trusted Developer Utilities Proxy Execution"
 56reference = "https://attack.mitre.org/techniques/T1127/"
 57[[rule.threat.technique.subtechnique]]
 58id = "T1127.001"
 59name = "MSBuild"
 60reference = "https://attack.mitre.org/techniques/T1127/001/"
 61
 62
 63
 64[rule.threat.tactic]
 65id = "TA0005"
 66name = "Defense Evasion"
 67reference = "https://attack.mitre.org/tactics/TA0005/"
 68[[rule.threat]]
 69framework = "MITRE ATT&CK"
 70[[rule.threat.technique]]
 71id = "T1059"
 72name = "Command and Scripting Interpreter"
 73reference = "https://attack.mitre.org/techniques/T1059/"
 74[[rule.threat.technique.subtechnique]]
 75id = "T1059.001"
 76name = "PowerShell"
 77reference = "https://attack.mitre.org/techniques/T1059/001/"
 78
 79[[rule.threat.technique.subtechnique]]
 80id = "T1059.003"
 81name = "Windows Command Shell"
 82reference = "https://attack.mitre.org/techniques/T1059/003/"
 83
 84[[rule.threat.technique.subtechnique]]
 85id = "T1059.005"
 86name = "Visual Basic"
 87reference = "https://attack.mitre.org/techniques/T1059/005/"
 88
 89
 90
 91[rule.threat.tactic]
 92id = "TA0002"
 93name = "Execution"
 94reference = "https://attack.mitre.org/tactics/TA0002/"
 95
 96[rule.new_terms]
 97field = "new_terms_fields"
 98value = ["host.id", "user.name", "process.command_line"]
 99[[rule.new_terms.history_window_start]]
100field = "history_window_start"
101value = "now-14d"