Detectionmediumtest
Suspicious Msbuild Execution By Uncommon Parent Process
Detects suspicious execution of 'Msbuild.exe' by a uncommon parent process
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation
Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.
Detection Logic
Detection Logic2 selectors
detection:
selection:
- Image|endswith: '\MSBuild.exe'
- OriginalFileName: 'MSBuild.exe'
filter_parent:
ParentImage|endswith:
- '\devenv.exe'
- '\cmd.exe'
- '\msbuild.exe'
- '\python.exe'
- '\explorer.exe'
- '\nuget.exe'
condition: selection and not filter_parentFalse Positives
Unknown
False positive likelihood has not been assessed. Additional context may be needed during triage.
MITRE ATT&CK
Tactics
Rule Metadata
Rule ID
33be4333-2c6b-44f4-ae28-102cdbde0a31
Status
test
Level
medium
Type
Detection
Created
Thu Nov 17
Author
Path
rules/windows/process_creation/proc_creation_win_msbuild_susp_parent_process.yml
Raw Tags
attack.defense-evasion