MSBuild.exe Outbound C2 Connection to rmrlx Infrastructure

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•3

Detects instances of MSBuild.exe executing from within the Microsoft.NET framework directory while initiating outbound network connections to a specific known command-and-control (C2) IP address associated with rmrlx infrastructure, or standalone network activity matching these parameters.