Suspicious MSBuild Execution from Non-Standard Directory
Detects the execution of the Microsoft Build Engine (msbuild.exe) with a project file (.proj) located in a suspicious, non-standard directory such as C:\ProgramData. This is a known "Living off the Land" technique (T1127.001) used by adversaries, including the PHALT#BLYX campaign, to proxy code execution through a trusted binary and evade defenses.
Microsoft Sentinel (KQL)
