Windows: Suspicious Msbuild.exe execution from uncommon parent process
Alerts when Msbuild.exe runs under an unexpected parent process on Windows.
FreeReviewedSigma · Medium · v1
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-11-17
- Updated
- 2026-07-30
What it detects
This rule flags process creation events where Msbuild.exe is launched by a parent process that is not in a small allowlist (e.g., devenv.exe, cmd.exe, msbuild.exe, python.exe, explorer.exe, nuget.exe). Attackers often use build tooling like Msbuild to execute code while blending in with legitimate software activity, so unexpected parent-child relationships are a useful indicator. It relies on Windows process creation telemetry including the child image name and the parent image path.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-suspicious-msbuild-exe-execution-from-uncommon-parent-process-33be4333
title: "Windows: Suspicious Msbuild.exe execution from uncommon parent process"
id: c11c25ce-afc5-4c2f-9662-5a70115997e6
status: test
description: This rule flags process creation events where Msbuild.exe is launched by a parent process that is not in a small allowlist (e.g., devenv.exe, cmd.exe, msbuild.exe, python.exe, explorer.exe, nuget.exe). Attackers often use build tooling like Msbuild to execute code while blending in with legitimate software activity, so unexpected parent-child relationships are a useful indicator. It relies on Windows process creation telemetry including the child image name and the parent image path.
references:
- https://app.any.run/tasks/abdf586e-df0c-4d39-89a7-06bf24913401/
- https://www.echotrail.io/insights/search/msbuild.exe
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_msbuild_susp_parent_process.yml
author: frack113, Huntrule Team
date: 2022-11-17
tags:
- attack.stealth
logsource:
category: process_creation
product: windows
detection:
selection:
- Image|endswith: \MSBuild.exe
- OriginalFileName: MSBuild.exe
filter_parent:
ParentImage|endswith:
- \devenv.exe
- \cmd.exe
- \msbuild.exe
- \python.exe
- \explorer.exe
- \nuget.exe
condition: selection and not filter_parent
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 33be4333-2c6b-44f4-ae28-102cdbde0a31
type: derived