| elastic |
Unusual Network Activity from a Windows System Binary |
production |
2026-10-19 |
| elastic |
Network Activity to a Suspicious Top Level Domain |
production |
2026-10-09 |
| splunk |
Suspicious MSBuild Rename |
deprecated |
2026-09-23 |
| elastic |
Microsoft Build Engine Started by a Script Process |
production |
2026-09-18 |
| elastic |
Microsoft Build Engine Started by a System Process |
production |
2026-09-18 |
| elastic |
Microsoft Build Engine Using an Alternate Name |
production |
2026-09-18 |
| elastic |
Microsoft Build Engine Started an Unusual Process |
production |
2026-09-18 |
| elastic |
Potential Credential Access via Trusted Developer Utility |
production |
2026-09-18 |
| elastic |
Microsoft Build Engine Started by an Office Application |
production |
2026-09-18 |
| elastic |
MsBuild Making Network Connections |
production |
2026-09-18 |
| elastic |
Suspicious Execution from a Mounted Device |
production |
2026-09-18 |
| elastic |
Delayed Execution via Ping |
production |
2026-09-18 |
| elastic |
Execution of Persistent Suspicious Program |
production |
2026-09-18 |
| elastic |
Process Injection by the Microsoft Build Engine |
production |
2026-09-18 |
| splunk |
Suspicious msbuild path |
production |
2026-05-13 |
| splunk |
MSBuild Suspicious Spawned By Script Process |
production |
2026-05-13 |
| splunk |
Suspicious MSBuild Spawn |
production |
2026-05-13 |
| sigma |
Silenttrinity Stager Msbuild Activity |
test |
2022-10-05 |