Rule Info
Name
Suspicious Msbuild Execution By Uncommon Parent Process
Author
frack113
Description
Detects suspicious execution of 'Msbuild.exe' by a uncommon parent process
Date
2022-11-17 00:00:00
Modified
None
Id
33be4333-2c6b-44f4-ae28-102cdbde0a31
Tags
attack.defense_evasion DEMO
Type
Community Rule
Link to Public Repo
Scan your endpoints, forensic images or collected files with our portable scanner THOR