Windows Process Execution: csc.exe Launched by w3wp.exe for MOVEit Pool

Flags IIS (w3wp.exe) spawning csc.exe within a MOVEit pool, consistent with dynamic compilation activity.

FreeUnreviewedSigmamediumv1

windows-process-execution-csc-exe-launched-by-w3wp-exe-for-moveit-pool-39ac1fb0

title: "Windows Process Execution: csc.exe Launched by w3wp.exe for MOVEit Pool"
id: 964beeed-04ff-42b9-b6ad-a3080c87d451
status: test
description: This rule matches process creation where w3wp.exe (IIS worker process) launches csc.exe when the parent command line contains "moveitdmz pool". The behavior is significant because dynamic compilation can be abused to create malicious assemblies during exploitation. It relies on Windows process creation telemetry, specifically the parent/child process image paths and the parent command line context.
references:
  - https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response
  - https://www.trustedsec.com/blog/critical-vulnerability-in-progress-moveit-transfer-technical-analysis-and-recommendations/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-34362-MOVEit-Transfer-Exploit/proc_creation_win_exploit_cve_2023_34362_moveit_transfer_exploitation_activity.yml
author: "@kostastsale, Huntrule Team"
date: 2023-06-01
tags:
  - attack.execution
  - attack.t1059
  - cve.2023-34362
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \w3wp.exe
    ParentCommandLine|contains: moveitdmz pool
    Image|endswith: \csc.exe
  condition: selection
falsepositives:
  - Initial software installation and software updates.
level: medium
license: DRL-1.1
related:
  - id: 39ac1fb0-07f1-474b-b97e-c5c0eace0d79
    type: derived

What it detects

This rule matches process creation where w3wp.exe (IIS worker process) launches csc.exe when the parent command line contains "moveitdmz pool". The behavior is significant because dynamic compilation can be abused to create malicious assemblies during exploitation. It relies on Windows process creation telemetry, specifically the parent/child process image paths and the parent command line context.

Known false positives

Initial software installation and software updates.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.