MSBuild Process Injection – Possible Lumma Stealer Activity
This rule detects suspicious execution of MSBuild.exe from non-standard user-writable temporary or roaming directories. Adversaries often abuse MSBuild.exe, a legitimate Microsoft utility, to proxy execution of malicious code, bypassing application control defenses. The rule specifically looks for MSBuild.exe running from common temporary or user-controlled paths like AppData\Local\Temp, AppData\Roaming, C:\Temp, or C:\Users\Public, which is indicative of potential malicious activity such as process injection or execution of infostealers like Lumma Stealer. Actions: Review the parent process (InitiatingProcess*) for suspicious names and command lines. Correlate with other indicators such as network connections, file writes, or registry changes. Investigate the dropped files or payloads around the execution timestamp.
Microsoft Sentinel (KQL)
