Detect MSBuild in Google Chronicle

rule msbuild_proxy_execution_t1127_001 {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects MSBuild.exe abuse for proxy execution of malicious code via inline task capability (T1127.001). Covers suspicious child process spawning, suspicious parent ancestry, project files in writable paths, and no-argument invocations."
    severity = "HIGH"
    priority = "HIGH"
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_technique = "T1127.001"
    reference = "https://attack.mitre.org/techniques/T1127/001/"
    created = "2026-04-18"

  events:
    (
      /* Branch 1: MSBuild spawning suspicious child processes */
      (
        $e.metadata.event_type = "PROCESS_LAUNCH"
        and re.regex($e.principal.process.file.full_path, `(?i)msbuild\.exe$`)
        and re.regex($e.target.process.file.full_path, `(?i)(cmd\.exe|powershell\.exe|pwsh\.exe|net\.exe|net1\.exe|whoami\.exe|ipconfig\.exe|nltest\.exe|certutil\.exe|bitsadmin\.exe|regsvr32\.exe|rundll32\.exe|mshta\.exe|wscript\.exe|cscript\.exe|schtasks\.exe|at\.exe|reg\.exe|sc\.exe|curl\.exe|wget\.exe)$`)
      )
      or
      /* Branch 2: MSBuild launched by suspicious parent */
      (
        $e.metadata.event_type = "PROCESS_LAUNCH"
        and re.regex($e.target.process.file.full_path, `(?i)msbuild\.exe$`)
        and re.regex($e.principal.process.file.full_path, `(?i)(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|explorer\.exe|outlook\.exe|winword\.exe|excel\.exe|powerpnt\.exe|rundll32\.exe|regsvr32\.exe|wmic\.exe)$`)
      )
      or
      /* Branch 3: MSBuild loading project file from suspicious path */
      (
        $e.metadata.event_type = "PROCESS_LAUNCH"
        and re.regex($e.target.process.file.full_path, `(?i)msbuild\.exe$`)
        and re.regex($e.target.process.command_line, `(?i)(\\temp\\|\\appdata\\local\\|\\appdata\\roaming\\|\\programdata\\|\\users\\public\\|\\windows\\tasks\\|\\desktop\\|\\downloads\\)`)
      )
      or
      /* Branch 4: MSBuild with no meaningful arguments */
      (
        $e.metadata.event_type = "PROCESS_LAUNCH"
        and re.regex($e.target.process.file.full_path, `(?i)msbuild\.exe$`)
        and (
          not $e.target.process.command_line != ""
          or re.regex($e.target.process.command_line, `(?i)^msbuild\.exe\s*$`)
        )
      )
    )

  condition:
    $e
}