Suspicious MSBuild Execution by Uncommon Parent Process

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

This rule detects the execution of 'MSBuild.exe' when its parent process is not one of the commonly associated legitimate processes such as 'devenv.exe', 'cmd.exe', 'msbuild.exe' itself, 'python.exe', 'explorer.exe', or 'nuget.exe'. This behavior can indicate an adversary abusing MSBuild for code execution or defense evasion.