Query: rule covering Detects execution of "csc.exe" to compile .NET code. Attackers often leverage this to compile code on the fly and use it
Matching passage: Sigma rule: Detects execution of "csc.exe" to compile .NET code. Attackers often leverage this to compile code on the fly and use it. Logsource: windows / process_creation. Rule: title: Dynamic .NET Compilation Via Csc.EXE id: dcaa3f04-70c3-427a-80b4-b870d73c94c4 status: test description: Detects execution of "csc.exe" to compile .NET code. Attackers often leverage this to compile code on the fly and use it in other stages. references: - https://securityboulevard.com/2019/08/agent-tesla-evading-edr-by-removing-api-hooks/ - https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf - https://app.any.run/tasks/c6993447-d1d8-414e-b856-675325e5aa09/ - https://twitter.com/gN3mes1s/status/1206874118282448897 - https://github.com/redcanaryco/atomic-red-team/blob/b27a3cb25025161d49ac861cb216db68c46a3537/atomics/T1027.004/T1027.004.md#atomic-test-1---compile-after-delivery-using-cscexe author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems) date: 2019-08-24 modified: 2026-03-23 tags: - attack.stealth - attack.t1027.004 logsource: category: process_creation product: windows detection: selection_img: Image|endswith: \csc.exe selection_susp_location_1: CommandLine|contains: - :\Perflogs\ - :\Users\Public\ - \AppData\Local\Temp\ - \Temporary Internet - \Windows\Temp\ selection_susp_location_2: - CommandLine|contains|all: - :\Users\ - \Favorites\ - CommandLine|contains|all: - :\Users\ - \Favourites\ - CommandLine|contains|all: - :\Users\ - \Contacts\ - CommandLine|contains|all: - :\Users\ - \Pictures\ selection_susp_location_3: CommandLine|re: (?:[Pp]rogram[Dd]ata|%(?:[Ll]ocal)?[Aa]pp[Dd]ata%|\\[Aa]pp[Dd]ata\\(?:[Ll]ocal(?:[Ll]ow)?|[Rr]oaming))\\[^\\]{1,256}$ filter_main_programfiles: ParentImage|startswith: - C:\Program Files (x86)\ - C:\Program Files\ filter_main_sdiagnhost: ParentImage: C:\Windows\System32\sdiagnhost.exe filter_main_w3p: ParentImage: C:\Windows\System32\inetsrv\w3wp.exe filter_optional_chocolatey: ParentImage: - C:\ProgramData\chocolatey\choco.exe - C:\ProgramData\chocolatey\tools\shimgen.exe filter_optional_defender: ParentCommandLine|contains: \ProgramData\Microsoft\Windows Defender Advanced Threat Protection filter_optional_ansible: ParentCommandLine|contains: - JwB7ACIAZgBhAGkAbABlAGQAIgA6AHQAcgB1AGUALAAiAG0AcwBnACIAOgAiAEEAbgBzAGkAYgBsAGUAIAByAGUAcQB1AGkAcgBlAHMAIABQAG8AdwBlAHIAUwBoAGUAbABsACAAdgAzAC4AMAAgAG8AcgAgAG4AZQB3AGUAcgAiAH0AJw - cAewAiAGYAYQBpAGwAZQBkACIAOgB0AHIAdQBlACwAIgBtAHMAZwAiADoAIgBBAG4AcwBpAGIAbABlACAAcgBlAHEAdQBpAHIAZQBzACAAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAMwAuADAAIABvAHIAIABuAGUAdwBlAHIAIgB9ACcA - nAHsAIgBmAGEAaQBsAGUAZAAiADoAdAByAHUAZQAsACIAbQBzAGcA
Near-miss passage: Sigma rule: Detects a DNS query by a non browser process on the system to "azurewebsites.net". The latter was often used by threat a. Logsource: windows / dns_query. Rule: title: DNS Query To AzureWebsites.NET By Non-Browser Process id: e043f529-8514-4205-8ab0-7f7d2927b400 related: - id: 5c80b618-0dbb-46e6-acbb-03d90bcb6d83 type: derived status: test description: 'Detects a DNS query by a non browser process on the system to "azurewebsites.net". The latter was often used by threat actors as a malware hosting and exfiltration site. ' references: - https://www.sentinelone.com/labs/wip26-espionage-threat-actors-abuse-cloud-infrastructure-in-targeted-telco-attacks/ - https://symantec-enterprise-blogs.security.com/threat-intelligence/harvester-new-apt-attacks-asia - https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/ - https://intezer.com/blog/research/how-we-escaped-docker-in-azure-functions/ author: Nasreddine Bencherchali (Nextron Systems) date: 2024-06-24 tags: - attack.command-and-control - attack.t1219.002 logsource: product: windows category: dns_query detection: selection: QueryName|endswith: azurewebsites.net filter_optional_chrome: Image: - C:\Program Files\Google\Chrome\Application\chrome.exe - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe filter_optional_firefox: Image: - C:\Program Files\Mozilla Firefox\firefox.exe - C:\Program Files (x86)\Mozilla Firefox\firefox.exe filter_optional_ie: Image: - C:\Program Files (x86)\Internet Explorer\iexplore.exe - C:\Program Files\Internet Explorer\iexplore.exe filter_optional_edge_1: - Image|startswith: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\ - Image|endswith: \WindowsApps\MicrosoftEdge.exe - Image: - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe - C:\Program Files\Microsoft\Edge\Application\msedge.exe filter_optional_edge_2: Image|startswith: - C:\Program Files (x86)\Microsoft\EdgeCore\ - C:\Program Files\Microsoft\EdgeCore\ Image|endswith: - \msedge.exe - \msedgewebview2.exe filter_optional_safari: Image|endswith: \safari.exe filter_optional_defender: Image|endswith: - \MsMpEng.exe - \MsSense.exe filter_optional_brave: Image|endswith: \brave.exe Image|startswith: C:\Program Files\BraveSoftware\ filter_optional_maxthon: Image|contains: \AppData\Local\Maxthon\ Image|endswith: \maxthon.exe filter_optional_opera: Image|contains: \AppData\Local\Programs\Opera\ Image|endswith: \opera.exe filter_optional_seamonkey: Image|startswith: - C:\Program Files\SeaMonkey\ - C:\Program Files (x86)\SeaMonkey\ Image|endswith: \seamonkey.exe filter_optional_vivaldi: Image|contains: \AppD