Masqueraded MSBuild in Startup Folder (TeamPCP Telnyx Campaign)
Detects the creation of an executable named 'msbuild.exe' or its associated '.lock' file inside the Windows user Startup folder by Python or CI/CD processes. This technique was observed in the TeamPCP campaign compromising the Telnyx Python SDK, where a fake MSBuild binary was dropped for stealthy persistence and the lock file was hidden via 'attrib +h'.
Sigma
