Developer Utility Used as Proxy for Code Execution

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects HTTP requests where the URI contains common developer utility executables (msbuild, csc, vbc, jsc) being used as a proxy for code execution. This behavior is often associated with defense evasion techniques where legitimate tools are leveraged for malicious purposes.