kqlElastic-2.0from elastic/detection-rules

Microsoft Build Engine Started an Unusual Process

Quality

FP risk

—

Forks

Views

ATT&CK techniques

T1027 T1027.004 T1127 T1127.001 T1059 T1059.001

Rule sourcerules/windows/defense_evasion_execution_msbuild_started_unusal_process.toml

host.os.type:windows and event.category:process and event.type:start and process.parent.name:("MSBuild.exe" or "msbuild.exe") and
process.name:("csc.exe" or "iexplore.exe" or "powershell.exe")