Windows: Suspicious Msbuild.exe execution from uncommon parent process

title: "Windows: Suspicious Msbuild.exe execution from uncommon parent process"
id: c11c25ce-afc5-4c2f-9662-5a70115997e6
status: test
description: This rule flags process creation events where Msbuild.exe is launched by a parent process that is not in a small allowlist (e.g., devenv.exe, cmd.exe, msbuild.exe, python.exe, explorer.exe, nuget.exe). Attackers often use build tooling like Msbuild to execute code while blending in with legitimate software activity, so unexpected parent-child relationships are a useful indicator. It relies on Windows process creation telemetry including the child image name and the parent image path.
references:
  - https://app.any.run/tasks/abdf586e-df0c-4d39-89a7-06bf24913401/
  - https://www.echotrail.io/insights/search/msbuild.exe
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_msbuild_susp_parent_process.yml
author: frack113, Huntrule Team
date: 2022-11-17
tags:
  - attack.stealth
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: \MSBuild.exe
    - OriginalFileName: MSBuild.exe
  filter_parent:
    ParentImage|endswith:
      - \devenv.exe
      - \cmd.exe
      - \msbuild.exe
      - \python.exe
      - \explorer.exe
      - \nuget.exe
  condition: selection and not filter_parent
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 33be4333-2c6b-44f4-ae28-102cdbde0a31
    type: derived