MSBuild and msxsl

Hypothesis and description

Trusted developer utilities such as MSBuild may be leveraged to run malicious code with elevated privileges. This analytic looks for any instances of msbuild.exe, which will execute any C# code placed within a given XML document; and msxsl.exe, which processes xsl transformation specifications for XML files and will execute a variaty of scripting languages contained within the XSL file. Both of these executables are rarely used outside of Visual Studio.

Platforms: Windows
Domain: Host
Subtypes: Process
Submitted: 2020-11-30
Contributors: Olaf Hartong

ATT&CK coverage

Technique	Tactics	Coverage
T1127 Trusted Developer Utilities Proxy ExecutionT1127.001	Stealth (formerly Defense Evasion)	High

1 technique, 2 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

T1127Trusted Developer Utilities Proxy Execution
.001 MSBuild

D3FEND techniques MITRE maps to this analytic

D3-PSA Process Spawn Analysis

Data model references

Fields from the CAR data model (object/action/field) the analytic reads.

Pseudocode and implementations

PseudocodePseudocode - msbuildData model: CAR native

This is a pseudocode representation of the below splunk search.

processes = search Process:Create
target_processes = filter processes where (
  (exe="C:\Program Files (x86)\Microsoft Visual Studio\*\bin\MSBuild.exe" OR exe="C:\Windows\Microsoft.NET\Framework*\msbuild.exe" OR exe="C:\users\*\appdata\roaming\microsoft\msxsl.exe") AND
  image_path!="*Microsoft Visual Studio*")
output target_processes

SplunkSplunk Search - msbuildData model: Sysmon native

Looks for all instances of msbuild.exe or msxsl.exe

(index=__your_sysmon_index__ EventCode=1) (Image="C:\\Program Files (x86)\\Microsoft Visual Studio\\*\\bin\\MSBuild.exe" OR Image="C:\\Windows\\Microsoft.NET\\Framework*\\msbuild.exe" OR Image="C:\\users\\*\\appdata\\roaming\\microsoft\\msxsl.exe") ParentImage!="*\\Microsoft Visual Studio*")

LogPointLogPoint Search - msbuildData model: LogPoint native

Looks for all instances of msbuild.exe or msxsl.exe

norm_id=WindowsSysmon event_id=1 (image IN ["C:\Program Files (x86)\Microsoft Visual Studio\*\bin\MSBuild.exe", "C:\Windows\Microsoft.NET\Framework*\msbuild.exe", "C:\Users\*\appdata\roaming\microsoft\msxsl.exe") -parent_image="*\Microsoft Visual Studio*")

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

3 more in the full list

View CAR-2020-11-008 on car.mitre.org

Hypothesis and description

Technique

Tactics

Coverage

T1127 Trusted Developer Utilities Proxy ExecutionT1127.001

Stealth (formerly Defense Evasion)

High

Pseudocode and implementations

PseudocodePseudocode - msbuildData model: CAR native

This is a pseudocode representation of the below splunk search.

processes = search Process:Create
target_processes = filter processes where (
  (exe="C:\Program Files (x86)\Microsoft Visual Studio\*\bin\MSBuild.exe" OR exe="C:\Windows\Microsoft.NET\Framework*\msbuild.exe" OR exe="C:\users\*\appdata\roaming\microsoft\msxsl.exe") AND
  image_path!="*Microsoft Visual Studio*")
output target_processes

SplunkSplunk Search - msbuildData model: Sysmon native

Looks for all instances of msbuild.exe or msxsl.exe

(index=__your_sysmon_index__ EventCode=1) (Image="C:\\Program Files (x86)\\Microsoft Visual Studio\\*\\bin\\MSBuild.exe" OR Image="C:\\Windows\\Microsoft.NET\\Framework*\\msbuild.exe" OR Image="C:\\users\\*\\appdata\\roaming\\microsoft\\msxsl.exe") ParentImage!="*\\Microsoft Visual Studio*")

LogPointLogPoint Search - msbuildData model: LogPoint native

Looks for all instances of msbuild.exe or msxsl.exe

norm_id=WindowsSysmon event_id=1 (image IN ["C:\Program Files (x86)\Microsoft Visual Studio\*\bin\MSBuild.exe", "C:\Windows\Microsoft.NET\Framework*\msbuild.exe", "C:\Users\*\appdata\roaming\microsoft\msxsl.exe") -parent_image="*\Microsoft Visual Studio*")