possible_msbuild_abuse_via_cmdline

rule possible_msbuild_abuse_via_cmdline {
 meta:
    author = "SOC Prime Team, Fireeye"
    description = "This alert looks for msbuild.exe process executions based on common command line arguments used for msbuild.exe. Attackers frequently use msbuild.exe (or renamed versions of this binary) to execute arbitrary CSharp payloads written to disk most commonly as .csproj files (though any file with an extension ending in \"proj\" will work) either referenced on the command line or located in the same directory as the msbuild.exe binary. The XML payload on disk should be acquired and examined to determine the functionality of the payload.  License: https://github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md."
    reference = "https://tdm.socprime.com/tdm/info/T83r6YqvuL3t"
    version = "0.01"
    created = "2021-03-09"
    category = "process_creation"
    product = "windows"
    mitre = "defense_evasion, execution, t1127"

  events:
(((re.regex($selection.target.process.command_line, `.*noconsolelogger.*`) or re.regex($selection.target.process.command_line, `.*noconlog.*`)) and ($selection.metadata.product_event_type = "4688" or $selection.metadata.product_event_type = "1")) and not ((re.regex($selection.target.process.command_line, `.*msbuild\.exe.*`) or re.regex($selection.target.process.file.full_path, `.*\\msbuild\.exe`) or (re.regex($selection.principal.process.file.full_path, `.*\.0\\bin\\nact\.exe.*`) or re.regex($selection.principal.process.file.full_path, `.*\\MSBuild\\15\.0\\Bin\\amd64\\Tracker\.exe.*`) or re.regex($selection.principal.process.file.full_path, `.*:\\Program Files\\dotnet\\dotnet\.exe.*`)))))

  condition:
    $selection
}