Anomalous MSBuild Network Connection
Detects the legitimate Windows utility MSBuild.exe initiating any outbound network connections. MSBuild.exe is a software build tool and should not typically make network connections outside of development environments. This behavior is highly indicative of process hollowing, where malware injects itself into the MSBuild process to evade defenses, as seen in recent BlindEagle campaigns.
Sigma
