Product
MSBuild Making Network Connections Indicating Potential Defense Evasion
2 rules 2 TTPsMsBuild.exe making outbound network connections may indicate adversarial activity as attackers leverage MsBuild to execute code and evade detection.
MSBuild Making Network Connections
2 rules 2 TTPsDetection of MsBuild.exe making outbound network connections which may indicate adversarial activity used to execute code and evade detection.
MSBuild запускает необычные процессы
2 rules 3 TTPsAdversaries may exploit MSBuild to execute malicious scripts or compile code, bypassing security controls; this rule detects unusual processes initiated by MSBuild, such as PowerShell or C# compiler, signaling potential misuse for executing unauthorized or harmful actions.
Suspicious MSBuild Execution from Scripting Processes
2 rules 6 TTPsAdversaries may use MSBuild, a legitimate Microsoft tool, to execute malicious code through script interpreters for defense evasion and execution on Windows systems.
MSBuild Process Injection Detection
2 rules 3 TTPsThe Microsoft Build Engine (MSBuild) is being abused to perform process injection by creating threads in other processes, a technique used to evade detection and potentially escalate privileges.
Microsoft Build Engine Executed After Renaming
2 rules 2 TTPsAttackers may rename the Microsoft Build Engine (MSBuild) executable to evade detection and proxy execution of malicious code.
Potential Credential Access via MSBuild Loading Credential Management DLLs
2 rules 1 TTPThe detection rule identifies a potential credential access attempt via the trusted developer utility MSBuild by detecting instances where it loads DLLs associated with Windows credential management, specifically vaultcli.dll or SAMLib.DLL, which is often used for credential dumping.