MSBuild Project Artifact Created in Unusual Directory

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects MSBuild project files created beneath C:\ProgramData, an uncommon location that has been abused by threat actors to stage malicious project files for code execution.