Suspicious MSBuild Spawn by WmiPrvSe

This analytic identifies instances where `wmiprvse.exe` spawns `msbuild.exe`. This behavior is unusual and indicates potential misuse of a COM object or a Living Off The Land (LOLBAS) technique. `msbuild.exe` is typically spawned by `devenv.exe` during legitimate Visual Studio use, not by `wmiprvse.exe`. If confirmed malicious, this could indicate an attacker executing arbitrary code or scripts, potentially leading to system compromise or further malicious activities.