Suspicious .NET process loads an MSBuild DLL

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	XDR Agent
ATT&CK Tactic	Stealth (TA0005)
ATT&CK Technique	Trusted Developer Utilities Proxy Execution: MSBuild (T1127.001)
Severity	Medium

Description

A suspicious process in the Microsoft .NET directory loaded the Microsoft Build Framework DLL. This may occur if an attacker masquerades a process like MSBuild (PowerLessShell).

Attacker's Goals

Gain code execution on the host and evade security controls.

Investigative actions

Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.