Suspicious Child Process of AspNetCompiler

Title: Suspicious Child Process of AspNetCompiler
Status: test
Description:Detects potentially suspicious child processes of "aspnet_compiler.exe".
References:
  -https://lolbas-project.github.io/lolbas/Binaries/Aspnet_Compiler/
  -https://ijustwannared.team/2020/08/01/the-curious-case-of-aspnet_compiler-exe/
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-08-14
modified:None
Tags:

• -'attack.execution'
• -'attack.stealth'
• -'attack.t1127'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_parent:
    ParentImage|endswith: '\aspnet_compiler.exe'
  selection_child:
    - Image|endswith:
      - '\calc.exe'
      - '\notepad.exe'
    - Image|contains:
      - '\Users\Public\'
      - '\AppData\Local\Temp\'
      - '\AppData\Local\Roaming\'
      - ':\Temp\'
      - ':\Windows\Temp\'
      - ':\Windows\System32\Tasks\'
      - ':\Windows\Tasks\'
  condition:all of selection_*
Falsepositives:
  -Unknown
Level: high