Additional msbuild.exe detection about threathunter-playbook

[Cyb3rWard0g]

Nice I like that @rdram0s ! We can probably add a section to each playbook to talk about a few use cases. "If X is common in your environment, you could add some more context by adding Y" How does that sound??

[rdram0s]

Reviewing this again, is this technique leveraging the msbuild.exe of .NET? I am trying to determine if I could/should filter the msbuild.exe from the actual location of Visual Studio. At the same time, I do not want to filter it if an attacker realizes my environment has Visual Studio installed. Thoughts?

[bfuzzy]

@rdram0s I wouldn't filter it out. I would baseline my environment and begin determining outliers. Tying other EventIDs in and looking for suspicious: Image, CommandLine, ParentImage, ParentCommandLine, and CurrentDirectory. Which will filter things down quite a bit.