Suspicious Child Process of AspNetCompiler
Attack scenariowindows:auditMITRE T1127
- By
- sigmahq
- Version
- 0.2
- Name
- sigmahq/proc_creation_win_aspnet_compiler_susp_child_process
- Remediation
- Alert only
Detects potentially suspicious child processes of "aspnet_compiler.exe".
Install with a top-level collection
1 collection include itsudo cscli collections install sigmahq/windows_proc_creationInstalls 1 parser and 520 scenarios.
View Windows - Suspicious Process Detection →Installation
sudo cscli scenarios install sigmahq/proc_creation_win_aspnet_compiler_susp_child_processThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
type: triggername: sigmahq/proc_creation_win_aspnet_compiler_susp_child_processdescription: |Detects potentially suspicious child processes of "aspnet_compiler.exe".filter: |(evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && (evt.Parsed.ParentImage endsWith '\\aspnet_compiler.exe' && (evt.Parsed.Image endsWith '\\calc.exe' || evt.Parsed.Image endsWith '\\notepad.exe' || evt.Parsed.Image contains '\\Users\\Public\\' || evt.Parsed.Image contains '\\AppData\\Local\\Temp\\' || evt.Parsed.Image contains '\\AppData\\Local\\Roaming\\' || evt.Parsed.Image contains ':\\Temp\\' || evt.Parsed.Image contains ':\\Windows\\Temp\\' || evt.Parsed.Image contains ':\\Windows\\System32\\Tasks\\' || evt.Parsed.Image contains ':\\Windows\\Tasks\\'))blackhole: 2m#status: testlabels:service: windowsconfidence: 1spoofable: 0classification:- attack.t1127label: "Suspicious Child Process of AspNetCompiler"behavior : "windows:audit"remediation: falsescope:type: ParentProcessIdexpression: evt.Parsed.ParentProcessId
Installed on
Know where it runs
Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.