Non-MSBuild developer utility spawns a script interpreter

Siemphony@siemphonymediumT1127unverified

AN0488's parent-child leg, scoped to the trusted developer utilities the technique's own citations name that are not MSBuild: the DNX execution environment and the Roslyn C# interactive REPL (both cited via the "DNX Bypass" and "RCSI Bypass" references), the WinDbg console debugger, the .NET CLI, IL assembler and MSBuild's separate file-tracking helper. MSBuild itself is deliberately excluded — it is the published T1127.001 sibling — so this rule and that one alert on disjoint ParentImage sets even though both match the same SuspiciousChildList shape MITRE gives in AN0488. The payload-write, unsigned-module-load and network-egress legs of the analytic are separate events with no join Sigma can express, so only the immediate child-spawn is checked; a utility that shells out after a delay, or that loads a malicious DLL without ever spawning a child process at all, will not match. Note the process source is Security 4688, which needs Audit Process Creation enabled and returns nothing at all without it. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0172, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((InitiatingProcessFolderPath endswith "\\dnx.exe" or InitiatingProcessFolderPath endswith "\\rcsi.exe" or InitiatingProcessFolderPath endswith "\\csi.exe" or InitiatingProcessFolderPath endswith "\\cdb.exe" or InitiatingProcessFolderPath endswith "\\windbg.exe" or InitiatingProcessFolderPath endswith "\\dotnet.exe" or InitiatingProcessFolderPath endswith "\\ilasm.exe" or InitiatingProcessFolderPath endswith "\\Tracker.exe") and (FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe" or FolderPath endswith "\\cmd.exe" or FolderPath endswith "\\wscript.exe" or FolderPath endswith "\\cscript.exe" or FolderPath endswith "\\mshta.exe" or FolderPath endswith "\\rundll32.exe" or FolderPath endswith "\\regsvr32.exe" or FolderPath endswith "\\certutil.exe"))

Splunk · SPL

Run this as a search.

index=* ((ParentImage="*\\dnx.exe" OR ParentImage="*\\rcsi.exe" OR ParentImage="*\\csi.exe" OR ParentImage="*\\cdb.exe" OR ParentImage="*\\windbg.exe" OR ParentImage="*\\dotnet.exe" OR ParentImage="*\\ilasm.exe" OR ParentImage="*\\Tracker.exe") AND (Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\cmd.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe" OR Image="*\\certutil.exe"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.parent.executable) LIKE "*\\\\dnx.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\rcsi.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\csi.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\cdb.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\windbg.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\dotnet.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\ilasm.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\tracker.exe") AND (TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pwsh.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cmd.exe" OR TO_LOWER(process.executable) LIKE "*\\\\wscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\mshta.exe" OR TO_LOWER(process.executable) LIKE "*\\\\rundll32.exe" OR TO_LOWER(process.executable) LIKE "*\\\\regsvr32.exe" OR TO_LOWER(process.executable) LIKE "*\\\\certutil.exe"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="ParentImage" type="pcre2">(?i)(\\dnx\.exe$|\\rcsi\.exe$|\\csi\.exe$|\\cdb\.exe$|\\windbg\.exe$|\\dotnet\.exe$|\\ilasm\.exe$|\\Tracker\.exe$)</field>    <field name="Image" type="pcre2">(?i)(\\powershell\.exe$|\\pwsh\.exe$|\\cmd\.exe$|\\wscript\.exe$|\\cscript\.exe$|\\mshta\.exe$|\\rundll32\.exe$|\\regsvr32\.exe$|\\certutil\.exe$)</field>    <description>Non-MSBuild developer utility spawns a script interpreter</description>    <mitre>      <id>T1127</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: signed_binary_proxy
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: ebcf6dba-b49f-4ea0-a046-155f76b898ff

ATT&CKT1127

T1127Trusted Developer Utilities Proxy Execution

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonsigned binary proxy

signed binary proxyAI draft — unreviewed

01 · What this rule detects

AN0488 describes a four-legged analytic: a trusted developer utility acting as parent, then (a) spawning a suspicious child, (b) loading an unsigned DLL, (c) writing and executing a new PE, or (d) making outbound connections. This rule covers only leg (a) — a single parent-child process pair. That's a precursor signal, not proof of proxy execution: Sigma has no join across the other three legs, so a utility that loads a malicious module without ever spawning a child, or shells out after a delay, will not match here at all.

02 · Telemetry you need

Security EventID 4688 (category: process_creation, product: windows). This source needs Audit Process Creation Policy enabled — without it the rule returns nothing, and that silence looks identical to a clean host. All four translation backends render this cleanly: Sentinel maps it onto SecurityEvent with EventID == 4688, Splunk and Elastic ESQL filter ParentImage/Image directly, and Wazuh compiles both lists into PCRE2 field regexes. Nothing is refused.

03 · How the logic works

selection_parent matches ParentImage|endswith against eight utilities — dnx.exe, rcsi.exe, csi.exe, cdb.exe, windbg.exe, dotnet.exe, ilasm.exe, Tracker.exe. This set is the technique's own citations (the DNX and RCSI bypass writeups, WinDbg) minus msbuild.exe, which is deliberately left out because it's covered by the sibling T1127.001 rule — same SuspiciousChildList shape, disjoint parent sets. selection_child matches Image|endswith against nine interpreters/LOLBins, instantiating MITRE's SuspiciousChildList knob. The values go beyond MITRE's own example (which names six: powershell, cmd, rundll32, regsvr32, wscript, mshta) — pwsh.exe, cscript.exe, and certutil.exe are the rule author's additions, not MITRE's. condition: selection_parent and selection_child is a plain AND on a single event — no aggregation, no time correlation, which is why MITRE's TimeWindow knob goes unused entirely.

04 · Common false positives

The declared top false positive is dotnet.exe build/test/publish pipelines shelling out to cmd.exe/powershell.exe for pre- or post-build steps — explicitly why level stays medium. Behind it: cdb.exe/windbg.exe scripting extensions launching helpers during routine debugging, and csi.exe REPL sessions running generated scripts.
The review's real catch is what's not in that list: Tracker.exe (MSBuild's FileTracker helper) sits in selection_parent with zero corresponding false-positive entry, even though it wraps and launches arbitrary build tools as its child on essentially every native/C++ MSBuild build. That's a plausibly high-volume legitimate trigger the falsepositives block never names — treat the listed FPs as incomplete, not exhaustive.

05 · Detection maturity

tier_1: .** status: experimental, never executed against real logs. The review's "usable-as-scaffold" verdict is a structural judgment — the evasion gap is disclosed accurately and the split against the T1127.001 sibling is clean — not a hit-rate claim. Actual noise volume, especially from Tracker.exe, is unknown until this runs read-only against real data.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Add explicit FP suppression for Tracker.exe wrapping known build tools
This rule leaves AllowedUtilitiesList, DeveloperHosts, and
Pair with image_load/file_event/network_connection rules for legs
If the rule produces zero hits, verify Audit Process Creation is actually

Declared by the author

dotnet.exe build and test pipelines on developer workstations and CI agents, where dotnet build/test/publish or a custom MSBuild target invoked through the dotnet CLI shells out to cmd.exe or powershell.exe for pre/post-build steps — this is the single highest-volume match this rule will produce, which is why the level below is not set higher.
Reverse-engineering and debugging workstations where cdb.exe or windbg.exe is used interactively and its scripting extensions launch a helper process as part of routine analysis work, indistinguishable on this logic alone from a debugger being used to proxy execution.
csi.exe (Roslyn C# Interactive) invoked from a build or notebook-style workflow that shells out to run a generated script, on hosts where interactive C# scripting is a normal developer tool rather than an anomaly.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification2 runs

Not verified

Security Datasets — Trusted developer utility proxy execution
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1127, evaluated against their process_creation events.

Share this rule

/u/siemphony/ebcf6dba-b49f-4ea0-a046-155f76b898ff

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Non-MSBuild developer utility spawns a script interpreter

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it