[metadata]
creation_date = "2020/03/25"
maturity = "production"
updated_date = "2020/12/17"

[rule]
author = ["Elastic"]
description = """
An instance of MSBuild, the Microsoft Build Engine, was started by Explorer or the WMI (Windows Management
Instrumentation) subsystem. This behavior is unusual and is sometimes used by malicious payloads.
"""
false_positives = ["The Build Engine is commonly used by Windows developers but use by non-engineers is unusual."]
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*"]
language = "kuery"
license = "Elastic License"
name = "Microsoft Build Engine Started by a System Process"
risk_score = 47
rule_id = "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae3"
severity = "medium"
tags = ["Elastic", "Host", "Windows", "Threat Detection", "Defense Evasion"]
type = "query"

query = '''
event.category:process and event.type:(start or process_started) and
  process.name:MSBuild.exe and
  process.parent.name:(explorer.exe or wmiprvse.exe)
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1127"
name = "Trusted Developer Utilities Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1127/"


[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[rule.threat]]
framework = "MITRE ATT&CK"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

