Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
72 detections
Filters
Last updated
All Time
Detection languages
36
19
7
5
2
Contributors
23
18
4
4
4
Categories
54
37
14
11
6
Platforms
72
3
Products / Services
30
27
16
5
2
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
IDS Classtypes
2
IDS Protocols
1
1
This rule detects instances of MSBuild.exe executing or communicating over the network while referencing .NET Framework paths. MSBuild is often abused as a LOLBAS (Living Off the Land Binary and Script) to execute arbitrary code or bypass application control, and unusual network activity from this process is a common indicator of beaconing or command-and-control communication.
Detects the use of MSBuild.exe to compile and execute inline code or tasks. The rule identifies suspicious command-line patterns (such as Task/CodeTaskFactory), execution from non-standard directories (Temp, AppData, Downloads, etc.), and subsequent network or child process activity originating from these MSBuild instances, indicating potential defense evasion or code execution.
This rule monitors for outbound TCP traffic from internal hosts to a specific IP address (212.34.141.103) on port 4521, which is associated with C2 beaconing behavior, potentially involving the abuse of MSBuild.exe as a LOLBin.
Detects execution of MSBuild.exe (Microsoft Build Engine) where the project file is located in a potentially user-writable, temporary, or staging directory, or when the command line includes indicators of inline task compilation (e.g., UsingTask or TaskFactory). This behavior is often associated with the use of MSBuild to proxy execution of arbitrary code to bypass application control mechanisms.
Detects MSBuild process execution originating from command shells loading obfuscated scripts or inline projects associated with PavinLoader.
Detects a suspicious sequence of Microsoft-signed .NET binaries (regsvcs.exe, installutil.exe, msbuild.exe, aspnet_compiler.exe) spawned by a single parent process in a short timeframe. This behavior is indicative of an attacker cycling through multiple trusted binaries in a fallback strategy to bypass application allowlisting or endpoint protection controls.
Detects potential abuse of MSBuild.exe or DotNet.exe as a proxy for executing arbitrary code. The rule identifies processes executing MSBuild or specific DotNet CLI operations (build, publish, test, pack) that do not originate from expected binary names, indicating a possible attempt to bypass application execution defenses using trusted developer utilities.
Detects MSBuild process execution originating from command shells loading obfuscated scripts or inline projects associated with PavinLoader.
Detects instances where msbuild.exe is used to execute project files (.proj) from suspicious or uncommon directories. Adversaries may abuse MSBuild to proxy execution of malicious code, often placing these project files in temporary or public user directories to evade detection.
Detects the abuse of MSBuild.exe to execute arbitrary code. The rule monitors for three primary suspicious behaviors: MSBuild spawning suspicious child processes indicative of inline task execution, MSBuild being launched with project file arguments from non-standard or untrusted parents, and MSBuild being launched without a project file (implying piped or inline payload delivery).
Detects suspicious execution of MSBuild.exe originating from non-standard parent processes or loading project/xml files from unconventional directories such as user-writable or temporary locations. This behavior is indicative of an attempt to bypass application whitelisting and execute arbitrary inline C# code via MSBuild's task functionality.
Detects the abuse of MSBuild.exe to execute arbitrary code. The rule monitors for three primary suspicious behaviors: MSBuild spawning suspicious child processes indicative of inline task execution, MSBuild being launched with project file arguments from non-standard or untrusted parents, and MSBuild being launched without a project file (implying piped or inline payload delivery).
Detects instances where msbuild.exe is used to execute project files (.proj) from suspicious or uncommon directories. Adversaries may abuse MSBuild to proxy execution of malicious code, often placing these project files in temporary or public user directories to evade detection.
Detects MSBuild project files created beneath C:\ProgramData, an uncommon location that has been abused by threat actors to stage malicious project files for code execution.
Detects suspicious execution of MSBuild.exe originating from non-standard parent processes or loading project/xml files from unconventional directories such as user-writable or temporary locations. This behavior is indicative of an attempt to bypass application whitelisting and execute arbitrary inline C# code via MSBuild's task functionality.
Correlates RuntimeHost.exe spawning suspended MSBuild.exe to inject mining shellcode, followed by network activity. This behavior is indicative of cryptojacking campaigns abusing ScreenConnect and .NET utilities.
Detects the rapid compilation of code via csc.exe, gcc.exe, or vbc.exe immediately following an outbound network connection to an LLM API (specifically api.openai.com), indicating AI-assisted malware generation on-the-fly. The rule joins network events showing a connection to OpenAI's API with process creation events for compilers within a two-minute window on the same device.
Detects PowerShell spawning csc.exe to dynamically compile the custom launcher (uds.exe) natively on the host.
This rule detects the execution of a social engineered installer followed by the spawning of hollowed binaries. It correlates the execution of executables with names matching common AI tools or generic setup files (e.g., deepseek, gpt, kimi, fraudgpt, ProFluxeFlowAi, setup) with the subsequent execution of .NET utility tools (InstallUtil.exe, RegAsm.exe, MSBuild.exe) that are often abused for process hollowing, especially when their command line does not contain a hyphen, indicating non-standard usage.
Detects broad hollowing logic involving injected Microsoft utilities (InstallUtil.exe, RegAsm.exe, RegSvcs.exe, aspnet_compiler.exe, MSBuild.exe) communicating over non-standard web command and control ports (8443, 5443, 8041). This rule specifically excludes common initiating processes like cmd.exe, powershell.exe, explorer.exe, and svchost.exe to reduce noise.
Detects the legitimate Microsoft .NET build component MSBuild.exe initiating outbound network connections to public IP addresses. This activity is a known LOLBin technique for establishing command and control (C2) or exfiltrating data. Threat actors have been observed abusing MSBuild.exe for host reconnaissance data exfiltration and C2 communications.
Page 2 of 4