Use of MSBuild as LOLBin

Description

Prior to deploying Macaw ransomware in an organization, the adversary frequently uses MSBuild.exe as a LOLBin to communicate with the C2.

Query · kql

DeviceProcessEvents 
| where InitiatingProcessFileName =~ "wmiprvse.exe" 
| where FileName =~ "msbuild.exe" and ProcessCommandLine has "programdata"
Raw source Use of MSBuild as LOLBin · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 166c732a-a02e-4c7a-a441-cb74fe3c3f2d
name: Use of MSBuild as LOLBin
description: |
  Prior to deploying Macaw ransomware in an organization, the adversary frequently uses MSBuild.exe as a LOLBin to communicate with the C2.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Command and control
query: |
  DeviceProcessEvents 
  | where InitiatingProcessFileName =~ "wmiprvse.exe" 
  | where FileName =~ "msbuild.exe" and ProcessCommandLine has "programdata"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.