Windows msbuild.exe Network Connections to Ports 80/443

Alerts on initiated outbound 80/443 connections from msbuild.exe on Windows.

FreeReviewedSigma · High · v2

Product: windows
Category: network_connection
Author: Kiran kumar s, oscd.community (SigmaHQ), DRL 1.1
Published: 2020-10-11
Updated: 2026-07-31

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1127.001MSBuild
Persistence
Priv Esc
Defense Evasion
- T1127.001MSBuild
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

Identifies instances where msbuild.exe initiates outbound network connections to destination ports 80 or 443. Attackers may abuse msbuild to download or stage additional components using common web ports, blending into normal outbound traffic. Telemetry relies on process/network connection events that include the connecting image path, destination port, and whether the connection was initiated by the host.

Reporting behind it

Related detections9 linkedT1127.001 — drag to rearrange

Suspicious MSBuild Execution Spawned by Interactive Shell for Code Proxying (via process_creation)

Suspicious MSBuild Spawned by PowerShell (via process_creation)

Suspicious MSBuild Execution of Project File from ProgramData (via process_creation)

Malicious MSBuild Execution of Downloaded csproj Project File (via process_creation)

Suspicious MSBuild Inline Task Compilation of mini.xml

Suspicious MSBuild Execution Spawned by Command Shell for Process Hollowing (via process_creation)

Suspicious MSBuild Execution of Inline Payload (via process_creation)

Suspicious MSBuild Execution as LOLBin from User-Writable Path (via process_creation)

Suspicious Local XML Compilation via MSBuild

Windows msbuild.exe Network Connections to Ports 80/443

Pivot detection · T1127.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-msbuild-exe-network-connection-to-web-ports-80-443-with-initiated-sessio-50e54b8d

title: Windows msbuild.exe Network Connections to Ports 80/443
id: cad4ce6a-0544-4699-aa85-da58210f0d56
status: test
description: Identifies instances where msbuild.exe initiates outbound network connections to destination ports 80 or 443. Attackers may abuse msbuild to download or stage additional components using common web ports, blending into normal outbound traffic. Telemetry relies on process/network connection events that include the connecting image path, destination port, and whether the connection was initiated by the host.
references:
  - https://www.blackhillsinfosec.com/my-first-joyride-with-silenttrinity/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_silenttrinity_stager_msbuild_activity.yml
author: Kiran kumar s, oscd.community, Huntrule Team
date: 2020-10-11
modified: 2022-10-05
tags:
  - attack.execution
  - attack.stealth
  - attack.t1127.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: \msbuild.exe
  filter:
    DestinationPort:
      - 80
      - 443
    Initiated: "true"
  condition: selection and filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 50e54b8d-ad73-43f8-96a1-5191685b17a4
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL