MSBuild Started by System Process

The Microsoft Build Engine (MSBuild) is a legitimate tool used for building applications, primarily by developers. However, attackers can abuse MSBuild to execute malicious code, taking advantage of its trusted status to bypass security measures. This detection identifies instances where MSBuild.exe is started by system processes like explorer.exe or wmiprvse.exe. This behavior is considered anomalous and may indicate an attempt to evade defenses and execute unauthorized actions on a Windows system. This activity can be indicative of defense evasion and execution-based attacks. The detection logic is based on process relationships, specifically monitoring MSBuild executions with unusual parent processes. The monitored processes include explorer.exe and wmiprvse.exe.

Attack Chain

1. The attacker gains initial access to the system (e.g., through phishing or exploiting a vulnerability).
2. The attacker uses a system process like explorer.exe or wmiprvse.exe as a launching point.
3. The attacker crafts a malicious MSBuild project file (.csproj or similar) containing malicious code or instructions.
4. The attacker invokes MSBuild.exe via explorer.exe or wmiprvse.exe to execute the crafted project file.
5. MSBuild.exe parses and executes the malicious code within the project file.
6. The malicious code performs actions such as downloading and executing payloads, modifying system configurations, or establishing persistence.
7. The attacker achieves their objective, which may include escalating privileges, stealing credentials, or deploying ransomware.

Impact

Successful exploitation can lead to code execution, privilege escalation, persistence, and ultimately, full system compromise. The attack is designed to evade traditional defenses by abusing a trusted system utility. The impact includes potential data theft, system disruption, or deployment of ransomware. This activity affects Windows systems and can bypass application control and other security measures relying on process whitelisting.

Recommendation

• Enable process monitoring with command-line auditing to detect the execution of MSBuild.exe with unusual parent processes (explorer.exe, wmiprvse.exe), as covered by the Sigma rule "Microsoft Build Engine Started by a System Process".
• Investigate any instances of MSBuild.exe being launched by explorer.exe or wmiprvse.exe, as described in the overview.
• Implement application control policies to restrict the execution of MSBuild.exe to authorized users and processes.
• Monitor for suspicious command-line arguments passed to MSBuild.exe that could indicate malicious activity, based on the rule description.