Masqueraded MSBuild.exe in Startup Folder
Detects the creation of a file named "msbuild.exe" within the Windows Startup folder. This behavior matches the persistence and masquerading techniques used by the TeamPCP threat actor following the compromise of the telnyx PyPI package.
Microsoft Sentinel (KQL)
