Windows Process Creation: Winword spawning csc.exe sub-process

Flags Word (WINWORD.EXE) spawning csc.exe, a suspicious execution pattern observed in some exploit chains.

FreeUnreviewedSigmacriticalv1

windows-process-creation-winword-spawning-csc-exe-sub-process-fdd84c68

title: "Windows Process Creation: Winword spawning csc.exe sub-process"
id: d2206a9b-7d9a-4ccf-8b4f-1b137d11d2e6
status: test
description: This rule identifies instances where WINWORD.EXE launches csc.exe, a behavior seen in some document-based exploitation chains. Attackers may use Word to spawn a compiler-like binary to execute follow-on payloads. Telemetry relies on Windows process creation events capturing parent and child process image paths ending with WINWORD.EXE and csc.exe.
references:
  - https://www.hybrid-analysis.com/sample/0b4ef455e385b750d9f90749f1467eaf00e46e8d6c2885c260e1b78211a51684?environmentId=100
  - https://www.reverse.it/sample/0b4ef455e385b750d9f90749f1467eaf00e46e8d6c2885c260e1b78211a51684?environmentId=100
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2017/Exploits/CVE-2017-8759/proc_creation_win_exploit_cve_2017_8759.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-09-15
modified: 2021-11-27
tags:
  - attack.execution
  - attack.t1203
  - attack.t1204.002
  - attack.initial-access
  - attack.t1566.001
  - cve.2017-8759
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \WINWORD.EXE
    Image|endswith: \csc.exe
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: fdd84c68-a1f6-47c9-9477-920584f94905
    type: derived

What it detects

This rule identifies instances where WINWORD.EXE launches csc.exe, a behavior seen in some document-based exploitation chains. Attackers may use Word to spawn a compiler-like binary to execute follow-on payloads. Telemetry relies on Windows process creation events capturing parent and child process image paths ending with WINWORD.EXE and csc.exe.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.