Rust Build Toolchain Spawning Interpreter or Downloader
Detects Rust build tools spawning command interpreters or download utilities, a behavior associated with malicious dependency and build-script execution.
// OVERVIEW: Detects Rust build tools spawning interpreters or download utilities,
// which may indicate malicious dependency or build-script execution.
// SOURCE HUNTPACK: Rust Build-Toolchain Supply-Chain Hunt
// MITRE: T1195.002, T1059
// CONF: medium | FP: medium | COST: low
// REQUIRES: ProcessRollup2, SyntheticProcessRollup2
// FALSE POSITIVES: Legitimate build scripts downloading dependencies or invoking shells.
// TUNING: Exclude approved CI wrappers, artifact mirrors, and known build scripts.
// LOOKBACK: 30d - set with the Falcon time picker.
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| in(ParentBaseFileName, values=["cargo.exe","cargo","rustc.exe","rustc"], ignoreCase=true)
| in(FileName, values=["powershell.exe","pwsh.exe","wscript.exe","cscript.exe","cmd.exe","curl.exe","curl","wget","bash","sh"], ignoreCase=true)
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, ParentCommandLine])
| sort(@timestamp, order=desc, limit=500)This query hunts for unusual child processes created by the Rust build toolchain. It is behavior-based and does not depend on package names, file hashes, domains, or other campaign-specific indicators.
Source: Rust Build-Toolchain Supply-Chain HuntPack.
-
Select process creation telemetry:
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/- Searches standard Falcon process events across supported endpoint platforms. -
Identify Rust build parents:
in(ParentBaseFileName, values=["cargo.exe","cargo","rustc.exe","rustc"], ignoreCase=true)- Restricts results to child processes launched directly by Cargo or the Rust compiler. -
Select interpreters and download utilities:
in(FileName, values=[...], ignoreCase=true)- Finds shells, scripting engines, and transfer utilities that can execute build scripts or retrieve additional content. -
Return investigation context:
table(...)andsort(...)- Presents the host, user, parent, child, and command lines with the newest events first.
False positives and tuning: Rust projects can legitimately use build.rs, CI wrappers, or vendoring scripts that invoke shells and download tools. Baseline approved build hosts and exclude only known build wrappers, internal artifact mirrors, and reviewed command lines.
Limitations: This query identifies suspicious build-tool behavior, not a confirmed supply-chain compromise. It only captures direct child processes; an additional wrapper process between the Rust tool and the interpreter may require a separate ancestry-based hunt.
