Rust Build Toolchain Spawning Interpreter or Downloader

# --- Query Metadata ---
# Human-readable name for the query. Will be displayed as the title.
name: "Rust Build Toolchain Spawning Interpreter or Downloader"

# MITRE ATT&CK technique IDs
mitre_ids:
  - "T1195.002"
  - "T1059"

# Description of what the query does and its purpose.
description: "Detects Rust build tools spawning command interpreters or download utilities, a behavior associated with malicious dependency and build-script execution."

# The author or team that created the query.
author: "slapopotamus"

# The required log sources to run this query successfully in Next-Gen SIEM.
log_sources:
  - Endpoint

# Tags for filtering and categorization.
tags:
  - Hunting

cs_required_modules:
  - Insight

# --- Query Content ---
# The actual CrowdStrike Query Language (CQL) code.
cql: |
  // OVERVIEW: Detects Rust build tools spawning interpreters or download utilities,
  // which may indicate malicious dependency or build-script execution.
  // SOURCE HUNTPACK: Rust Build-Toolchain Supply-Chain Hunt
  // MITRE: T1195.002, T1059
  // CONF: medium | FP: medium | COST: low
  // REQUIRES: ProcessRollup2, SyntheticProcessRollup2
  // FALSE POSITIVES: Legitimate build scripts downloading dependencies or invoking shells.
  // TUNING: Exclude approved CI wrappers, artifact mirrors, and known build scripts.
  // LOOKBACK: 30d - set with the Falcon time picker.
  #event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
  | in(ParentBaseFileName, values=["cargo.exe","cargo","rustc.exe","rustc"], ignoreCase=true)
  | in(FileName, values=["powershell.exe","pwsh.exe","wscript.exe","cscript.exe","cmd.exe","curl.exe","curl","wget","bash","sh"], ignoreCase=true)
  | table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, ParentCommandLine])
  | sort(@timestamp, order=desc, limit=500)

# Explanation of the query. Uses markdown for formatting on the webpage.
explanation: |
  This query hunts for unusual child processes created by the Rust build toolchain. It is behavior-based and does not depend on package names, file hashes, domains, or other campaign-specific indicators.

  Source: [Rust Build-Toolchain Supply-Chain HuntPack](https://slapopotamus.github.io/HuntPack/hunts/Arrayref-RustCrate-SupplyChain-Hunt.html).

  1. **Select process creation telemetry**: `#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/`
     - Searches standard Falcon process events across supported endpoint platforms.

  2. **Identify Rust build parents**: `in(ParentBaseFileName, values=["cargo.exe","cargo","rustc.exe","rustc"], ignoreCase=true)`
     - Restricts results to child processes launched directly by Cargo or the Rust compiler.

  3. **Select interpreters and download utilities**: `in(FileName, values=[...], ignoreCase=true)`
     - Finds shells, scripting engines, and transfer utilities that can execute build scripts or retrieve additional content.

  4. **Return investigation context**: `table(...)` and `sort(...)`
     - Presents the host, user, parent, child, and command lines with the newest events first.

  **False positives and tuning:** Rust projects can legitimately use `build.rs`, CI wrappers, or vendoring scripts that invoke shells and download tools. Baseline approved build hosts and exclude only known build wrappers, internal artifact mirrors, and reviewed command lines.

  **Limitations:** This query identifies suspicious build-tool behavior, not a confirmed supply-chain compromise. It only captures direct child processes; an additional wrapper process between the Rust tool and the interpreter may require a separate ancestry-based hunt.