MSBuild.exe Outbound Network Connection to Public IP

Ethan Andrews@eandrews

•updated Jun 10, 2026•12•0•32

Detects the legitimate Microsoft .NET build component MSBuild.exe initiating outbound network connections to public IP addresses. This activity is a known LOLBin technique for establishing command and control (C2) or exfiltrating data. Threat actors have been observed abusing MSBuild.exe for host reconnaissance data exfiltration and C2 communications.