Potential MOVEit Transfer CVE-2023-34362 Exploitation - Dynamic Compilation Via Csc.EXE
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects the execution of "csc.exe" via "w3wp.exe" process. MOVEit affected hosts execute "csc.exe" via the "w3wp.exe" process to dynamically compile malicious DLL files. MOVEit is affected by a critical vulnerability. Exploited hosts show evidence of dynamically compiling a DLL and writing it under C:\\\\Windows\\\\Microsoft\\.NET\\\\Framework64\\\\v4\\.0\\.30319\\\\Temporary ASP\\.NET Files\\\\root\\\\([a-z0-9]{5,12})\\\\([a-z0-9]{5,12})\\\\App_Web_[a-z0-9]{5,12}\\.dll. Hunting Opportunity Events from IIS dynamically compiling binaries via the csc.exe on behalf of the MOVEit application, especially since May 27th should be investigated.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Process started" AND PARENTPROCESSNAME endswith "\w3wp.exe" AND PARENTPROCESSCOMMANDLINE contains "moveitdmz pool" AND PROCESSNAME endswith "\csc.exe" select Action1.HOSTNAME,Action1.MESSAGE,Action1.COMMANDLINE,Action1.FILE_NAME,Action1.PROCESSNAME,Action1.USERNAME,Action1.PARENTPROCESSNAME
Detection
Execution Mode
realtime
Log Sources
Windows
Author
@kostastsale
