Suspicious process spawns MSBuild.exe

BIOC Medium

Suspicious process spawns MSBuild.exe

The Microsoft Build Engine was started by an abnormal process. MSBuild is normally used for development purposes, so this unusual behavior may be malicious.

Module:: Platform Analytics
Agent event type:: Process execution
Category:: Execution
Status:: Enabled

ATT&CK tactics: Defense Evasion (TA0005)

ATT&CK techniques: Trusted Developer Utilities Proxy Execution: MSBuild (T1127.001) Obfuscated Files or Information: Compile After Delivery (T1027.004)

Indicator:

Process action type = execution AND target process name = msbuild.exe Process initiated by = explorer.exe , wmiprvse.exe , wscript.exe , cscript.exe Host host os = windows

Preventable: yes