Cryptojacking via ScreenConnect - Process Hollowing MSBuild
Correlates RuntimeHost.exe spawning suspended MSBuild.exe to inject mining shellcode, followed by network activity. This behavior is indicative of cryptojacking campaigns abusing ScreenConnect and .NET utilities.
Microsoft Sentinel (KQL)
