Signed Binary Proxy Execution via MSBuild Network Egress or Regsvr32 Squiblydoo
Detects two distinct methods of living-off-the-land proxy execution: first, MSBuild.exe spawning network connections after executing inline tasks defined in XML project files; second, Regsvr32.exe performing 'Squiblydoo' execution by loading COM scriptlets from remote URLs.
YARA-L
