AN1535
Analytic 1535
Windows
MSBuild.exe is invoked outside expected developer/build contexts or with anomalous arguments (e.g., non-canonical paths, remote shares, Base64/obfuscated property values). Within a short window, it (a) spawns high-risk LOLBins/script interpreters, (b) writes new PE/DLL/script artifacts into user-writable paths and executes them, (c) loads unsigned/user-writable modules, (d) performs memory injection/thread creation into other processes, and/or (e) initiates outbound network connections.
WinEventLog:Security
EventCode=4688
WinEventLog:Sysmon
EventCode=7
WinEventLog:Sysmon
EventCode=11
WinEventLog:Sysmon
EventCode=3, 22
WinEventLog:Sysmon
EventCode=8
WinEventLog:Sysmon
EventCode=10
WinEventLog:Microsoft-Windows-CodeIntegrity/Operational
Unsigned/invalid signature modules or images loaded by msbuild.exe or its children
EDR:AMSI
Malicious inline C#/script blobs embedded in MSBuild projects if intercepted by AMSI-aware loaders (rare but possible via chained LOLBins)
[TimeWindow]
Correlation window between msbuild.exe start, payload write, suspicious child spawn, and network (e.g., 0–30 minutes).
[DeveloperHosts]
Tag/allowlist known developer or CI/CD hosts to reduce noise.
[SuspiciousChildList]
High-risk children (powershell.exe, rundll32.exe, regsvr32.exe, cmd.exe, wscript.exe, mshta.exe) spawned by msbuild.exe.
[RarePathRegex]
Regex of user-writable or atypical paths (e.g., %TEMP%, %APPDATA%, OneDrive sync dirs) used to drop payloads.
[UnsignedOrInvalidSignatureOnly]
Tighten alerting to cases with invalid or missing signatures on modules/children.
[NetworkReputationThreshold]
Minimum rarity/risk score for external destinations to alert.
[BehaviorRiskScoreThreshold]
Numeric threshold for fused, scored correlation (e.g., ≥70/100 triggers an alert).